oss-security - Re: Re: [CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the error message {AKA request for feedback if CVE to be marked as disputed / rejected}

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52094418.1040708@redhat.com>
Date: Mon, 12 Aug 2013 14:22:48 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: mancha <mancha1@...h.com>, Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: Re: [CVE assignment notification] CVE-2012-2142
 poppler, xpdf: Insufficient sanitization of escape sequences in the error
 message {AKA request for feedback if CVE to be marked as disputed / rejected}

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/10/2013 11:47 PM, mancha wrote:
> Jan Lieskovsky <jlieskov@...> writes:
> 
>> Poppler upstream patch:
>> 
> http://cgit.freedesktop.org/poppler/poppler/commit/?id=71bad47ed6a36d825b0d08992c8db56845c71e40
>>
>>
> 
Regards, Jan.
>> -- Jan iankko Lieskovsky / Red Hat Security Response Team
>> 
> 
> Hi. I've adapted Poppler's CVE-2012-2142 fix to xpdf-3.03 and
> posted here: 
> http://sourceforge.net/projects/miscellaneouspa/files/misc/xpdf-3.03-CVE-2012-2142.diff
>
>  --mancha
> 

I assume we'll SPLIT this? In past some xpdf/poppler issues have been
merged circa 2010, but after that they appear to have been usually
treated as separate:

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=poppler
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=xpdf

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJSCUQYAAoJEBYNRVNeJnmTC6gQANU/SwWPW8nRgWHGwjzf65uK
pt5DxZfaD+CXdCClh54qrDxdo+LjGAo4UwZ3wnccZBZZPdz5332J3ReB+Mg87mSJ
apj87d9ygLIPs9axHOeQfPUReg0b45fk+gZXepn1CnndXX5nyqB9yQxZxXxt51Qe
aG5UDxIn/ZDXuc+NYQyEKY8pWHkSo/7kti19EPDLDbl3gZJQUglaOVozfiTdJT2j
XE0sg+CBc4azEzBw3flEYJ3lXLGXw85RTDgt4/+KfqfqI4BrorfqYNgm9ZrhjSQO
z2XomL/0zM4hVnJOLbdbUPICR3uekbDRY2ne/+zP4HebWg0ckY4Jhm9kTMU6eVVo
l2yIcw5CByfjTqg91yLItfBuGIxivj1W76Da0I6l8UNUDni6tj7ze3B2r27cYT4Y
gTqOpUF7AUvxbLhu7Op7kHxQfsXcmpjWjK9EE7BwY8IAVmA4C+VOqciQISOIZZt5
0ejLvXasZxqGWmq570A9f2c4g5ADjr06shQW/KPl0Oo72PfUUni4SXHAf/YoE2M2
BgghaQ/mf/Q0nznLK60azKwypazcU4HziRwjaROz0qg8Q/5bpemcAfKTXbDQCHcq
Gu97hqVYyXgHJyYcwbZ9QZBww3xIUtR7XaThIa8gqw/Xl9bufmBSn7HRxad1cHlh
mKrmsatsNitCAbGcM3b2
=IeYL
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.