-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : xpdf SUMMARY : Embedded commands execution vulnerability DATE : 2003-07-04 10:57:00 ID : CLA-2003:674 RELEVANT RELEASES : 7.0, 8, 9 - ------------------------------------------------------------------------- DESCRIPTION Xpdf is a viewer for Portable Document Format (PDF) files. This update fixes a vulnerability that allows attackers to embed commands in document hyperlinks. If the user clicks in an hyperlink created by the attacker, it can execute malicious commands when calling a external program (web browsers, mail programs, etc). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0434 to this issue. SOLUTION All xpdf users should upgrade. REFERENCES: 1.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0434 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xpdf-0.92-2U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/xpdf-0.92-2U70_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/xpdf-0.93-2U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/xpdf-0.93-2U80_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/xpdf-2.01-22930U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/xpdf-2.01-22930U90_1cl.src.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright (c) 2003 Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribeat_private unsubscribe: conectiva-updates-unsubscribeat_private -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE/BYha42jd0JmAcZARAsD0AJ41Etq1PxMurfUFqsXc0te4V0+QiQCfcxsp REDyGm0tqfrsQ0bTaaGNHiQ= =d2kV -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Fri Jul 04 2003 - 08:52:59 PDT