Security update for qpdf SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0469-1 Final 1 1 2018-02-19T09:09:04Z current 2018-02-19T09:09:04Z 2018-02-19T09:09:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for qpdf This version update for qpdf to 7.1.1 fixes the following issues: - Update to version 7.1.1 * Fix one linearization bug affecting files whose first /ID component is not 16 bytes long - Update to version 7.1.0 * Allow raw encryption key to be specified in libary and command line with the QPDF::setPasswordIsHexKey method and --password-is-hex-key option. Allow encryption key to be displayed with --show-encryption-key option. See https://blog.didierstevens.com/2017/12/28/cracking-encrypted-pdfs-part-3/ for a discussion of using this for cracking encrypted PDFs. I hope that a future release of qpdf will include some additional recovery options that may also make use of this capability. * Fix lexical error: the PDF specification allows floating point numbers to end with '.' * Fix link order in the build to avoid conflicts when building from source while an older version of qpdf is installed * Add support for TIFF predictor for LZW and Flate streams. Now * Clarify documentation around options that control parsing but not output creation. Two options: --suppress-recovery and --ignore-xref-streams, were documented in the 'Advanced Transformation Options' section of the manual and --help output even though they are not related to output. These are now described in a separate section called 'Advanced Parsing Options.' * Implement remaining PNG filters for decode. Prior versions could decode only the 'up' filter. Now all PNG filters (sub, up, average, Paeth, optimal) are supported for decoding. The implementation of the remaining PNG filters changed the interface to the private Pl_PNGFilter class, but this class's header file is not in the installation, and there is no public interface to the class. Within the library, the class is never allocated on the stack; it is only ever dynamically allocated. As such, this does not actually break binary compatibility of the library. all predictor functions are supported - Update to version 7.0.0 * License is now Apache-2.0 * Add new libjpeg8-devel dependency * Improve the error message that is issued when QPDFWriter encounters a stream that can't be decoded. In particular, mention that the stream will be copied without filtering to avoid data loss. * Add new methods to the C API to correspond to new additions to QPDFWriter: - qpdf_set_compress_streams - qpdf_set_decode_level - qpdf_set_preserve_unreferenced_objects - qpdf_set_newline_before_endstream * Add support for writing PCLm files * QPDF now supports reading and writing streams encoded with JPEG or RunLength encoding. Library API enhancements and command-line options have been added to control this behavior. See command-line options --compress-streams and --decode-level and methods QPDFWriter::setCompressStreams and QPDFWriter::setDecodeLevel. * Page rotation is now supported and accessible from both the library and the command line. * Fixes CVE-2017-12595 boo#1055960, CVE-2017-9208 boo#1040311 CVE-2017-9209 boo#1040312, CVE-2017-9210 boo#1040313, CVE-2017-11627 boo#1050577, CVE-2017-11626 boo#1050578, CVE-2017-11625 boo#1050579, CVE-2017-11624 boo#1050581 - Update to version 6.0.0 * Bump shared library version since 5.2.0 broke ABI. - Update to version 5.2.0 * Support for deterministic /IDs for non-encrypted files. This is off by default. * Handle more invalid xref tables The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html E-Mail link for openSUSE-SU-2018:0469-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 cups-filters-1.8.2-4.2.1 cups-filters-cups-browsed-1.8.2-4.2.1 cups-filters-devel-1.8.2-4.2.1 cups-filters-foomatic-rip-1.8.2-4.2.1 cups-filters-ghostscript-1.8.2-4.2.1 libqpdf18-7.1.1-6.3.1 qpdf-7.1.1-6.3.1 qpdf-devel-7.1.1-6.3.1 cups-filters-1.8.2-4.2.1 as a component of openSUSE Leap 42.3 cups-filters-cups-browsed-1.8.2-4.2.1 as a component of openSUSE Leap 42.3 cups-filters-devel-1.8.2-4.2.1 as a component of openSUSE Leap 42.3 cups-filters-foomatic-rip-1.8.2-4.2.1 as a component of openSUSE Leap 42.3 cups-filters-ghostscript-1.8.2-4.2.1 as a component of openSUSE Leap 42.3 libqpdf18-7.1.1-6.3.1 as a component of openSUSE Leap 42.3 qpdf-7.1.1-6.3.1 as a component of openSUSE Leap 42.3 qpdf-devel-7.1.1-6.3.1 as a component of openSUSE Leap 42.3 A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop." CVE-2017-11624 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-11624.html CVE-2017-11624 https://bugzilla.suse.com/1050581 SUSE Bug 1050581 A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop." CVE-2017-11625 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-11625.html CVE-2017-11625 https://bugzilla.suse.com/1050579 SUSE Bug 1050579 A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop." CVE-2017-11626 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-11626.html CVE-2017-11626 https://bugzilla.suse.com/1050578 SUSE Bug 1050578 A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop." CVE-2017-11627 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-11627.html CVE-2017-11627 https://bugzilla.suse.com/1050577 SUSE Bug 1050577 The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc. CVE-2017-12595 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-12595.html CVE-2017-12595 https://bugzilla.suse.com/1055960 SUSE Bug 1055960 libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to releaseResolved functions, aka qpdf-infiniteloop1. CVE-2017-9208 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-9208.html CVE-2017-9208 https://bugzilla.suse.com/1040311 SUSE Bug 1040311 libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to QPDFObjectHandle::parseInternal, aka qpdf-infiniteloop2. CVE-2017-9209 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-9209.html CVE-2017-9209 https://bugzilla.suse.com/1040312 SUSE Bug 1040312 libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to unparse functions, aka qpdf-infiniteloop3. CVE-2017-9210 openSUSE Leap 42.3:cups-filters-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-cups-browsed-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-devel-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-foomatic-rip-1.8.2-4.2.1 openSUSE Leap 42.3:cups-filters-ghostscript-1.8.2-4.2.1 openSUSE Leap 42.3:libqpdf18-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-7.1.1-6.3.1 openSUSE Leap 42.3:qpdf-devel-7.1.1-6.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html https://www.suse.com/security/cve/CVE-2017-9210.html CVE-2017-9210 https://bugzilla.suse.com/1040313 SUSE Bug 1040313