pdftohtml: Vulnerabilities in included Xpdf — GLSA 200502-10

pdftohtml includes vulnerable Xpdf code to handle PDF files, making it vulnerable to execution of arbitrary code upon converting a malicious PDF file.

Affected packages

Background

pdftohtml is a utility to convert PDF files to HTML or XML formats. It makes use of Xpdf code to decode PDF files.

Description

Xpdf is vulnerable to a buffer overflow, as described in GLSA 200501-28.

Impact

An attacker could entice a user to convert a specially-crafted PDF file, potentially resulting in the execution of arbitrary code with the rights of the user running pdftohtml.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-text/pdftohtml-0.36-r3"

References

• GLSA 200501-28
• CAN-2005-0064

Release date
February 09, 2005

Latest revision
February 09, 2005: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 78629