-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:101
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : xpdf
 Date    : April 28, 2009
 Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0
 _______________________________________________________________________

 Problem Description:

 Multiple buffer overflows in the JBIG2 decoder allows remote
 attackers to cause a denial of service (crash) via a crafted PDF file
 (CVE-2009-0146).
 
 Multiple integer overflows in the JBIG2 decoder allows remote
 attackers to cause a denial of service (crash) via a crafted PDF file
 (CVE-2009-0147).
 
 An integer overflow in the JBIG2 decoder has unspecified
 impact. (CVE-2009-0165).
 
 A free of uninitialized memory flaw in the the JBIG2 decoder allows
 remote to cause a denial of service (crash) via a crafted PDF file
 (CVE-2009-0166).
 
 Multiple input validation flaws in the JBIG2 decoder allows
 remote attackers to execute arbitrary code via a crafted PDF file
 (CVE-2009-0800).
 
 An out-of-bounds read flaw in the JBIG2 decoder allows remote
 attackers to cause a denial of service (crash) via a crafted PDF file
 (CVE-2009-0799).
 
 An integer overflow in the JBIG2 decoder allows remote attackers to
 execute arbitrary code via a crafted PDF file (CVE-2009-1179).
 
 A free of invalid data flaw in the JBIG2 decoder allows remote
 attackers to execute arbitrary code via a crafted PDF (CVE-2009-1180).
 
 A NULL pointer dereference flaw in the JBIG2 decoder allows remote
 attackers to cause denial of service (crash) via a crafted PDF file
 (CVE-2009-1181).
 
 Multiple buffer overflows in the JBIG2 MMR decoder allows remote
 attackers to cause denial of service or to execute arbitrary code
 via a crafted PDF file (CVE-2009-1182, CVE-2009-1183).
 
 This update provides fixes for that vulnerabilities.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0146
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0147
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0165
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0166
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0799
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0800
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1179
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1180
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1181
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1182
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1183
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 ca5d4aa0fd4d773a0c07152230125a17  2008.0/i586/xpdf-3.02-8.2mdv2008.0.i586.rpm
 c559996e39714143bf05932da647f366  2008.0/i586/xpdf-common-3.02-8.2mdv2008.0.i586.rpm
 faf1b71ba57c4dc04e13967efe905022  2008.0/i586/xpdf-tools-3.02-8.2mdv2008.0.i586.rpm 
 e7a41f655996dc3fe042792834c98f53  2008.0/SRPMS/xpdf-3.02-8.2mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 c5679f6c06322aa5771721eff8b04f52  2008.0/x86_64/xpdf-3.02-8.2mdv2008.0.x86_64.rpm
 268fe7bc2cab7dc799958b8cbb1d0cf1  2008.0/x86_64/xpdf-common-3.02-8.2mdv2008.0.x86_64.rpm
 4fc6ea9b648664b86034e7a705a5d4ad  2008.0/x86_64/xpdf-tools-3.02-8.2mdv2008.0.x86_64.rpm 
 e7a41f655996dc3fe042792834c98f53  2008.0/SRPMS/xpdf-3.02-8.2mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 44669f3080692ccd8a36f2c6ceccef94  2008.1/i586/xpdf-3.02-10.1mdv2008.1.i586.rpm
 3df82267b407e35f8cce33902fd25282  2008.1/i586/xpdf-common-3.02-10.1mdv2008.1.i586.rpm 
 3ef4252f9c88a7ec76b5d2289cd47586  2008.1/SRPMS/xpdf-3.02-10.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 513359e39e158cb9a0897dfdc636d7ff  2008.1/x86_64/xpdf-3.02-10.1mdv2008.1.x86_64.rpm
 07116c6ca3f91cff7db289a3b2454b53  2008.1/x86_64/xpdf-common-3.02-10.1mdv2008.1.x86_64.rpm 
 3ef4252f9c88a7ec76b5d2289cd47586  2008.1/SRPMS/xpdf-3.02-10.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 b4f7a0c5a77a5e4c976d3c5d4962260d  2009.0/i586/xpdf-3.02-12.1mdv2009.0.i586.rpm
 c2539bdb62cfd965b4833498c01e1476  2009.0/i586/xpdf-common-3.02-12.1mdv2009.0.i586.rpm 
 e98cd0e2ddaf8e38545517ca3c5a52c9  2009.0/SRPMS/xpdf-3.02-12.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 a8f3f47b0f7abab2e14278ef3a9ab949  2009.0/x86_64/xpdf-3.02-12.1mdv2009.0.x86_64.rpm
 e8149bd894a353b26a6d649a1b2c4f80  2009.0/x86_64/xpdf-common-3.02-12.1mdv2009.0.x86_64.rpm 
 e98cd0e2ddaf8e38545517ca3c5a52c9  2009.0/SRPMS/xpdf-3.02-12.1mdv2009.0.src.rpm

 Corporate 3.0:
 e5c3d7b817a68494e9196f03912c1cbf  corporate/3.0/i586/xpdf-3.02-0.2.C30mdk.i586.rpm
 3b59d02393cdf7faf7ad6defa6fd1c1d  corporate/3.0/i586/xpdf-tools-3.02-0.2.C30mdk.i586.rpm 
 cee0a0b2af176cb5d57118f24ff709ef  corporate/3.0/SRPMS/xpdf-3.02-0.2.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 16d8f445db66382e04f9069f0d1ea0b7  corporate/3.0/x86_64/xpdf-3.02-0.2.C30mdk.x86_64.rpm
 e1b540672b1294126341ea59d4a7cc61  corporate/3.0/x86_64/xpdf-tools-3.02-0.2.C30mdk.x86_64.rpm 
 cee0a0b2af176cb5d57118f24ff709ef  corporate/3.0/SRPMS/xpdf-3.02-0.2.C30mdk.src.rpm

 Corporate 4.0:
 6427d710feee38e81cfc6f8ea83d33f4  corporate/4.0/i586/xpdf-3.02-0.2.20060mlcs4.i586.rpm
 b72effda26fc1ce0efc67a89bdec2b8d  corporate/4.0/i586/xpdf-tools-3.02-0.2.20060mlcs4.i586.rpm 
 0dc34a5646041ead38fa548b6d077e30  corporate/4.0/SRPMS/xpdf-3.02-0.2.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 15790cc89933284c5bf608073b30e9c0  corporate/4.0/x86_64/xpdf-3.02-0.2.20060mlcs4.x86_64.rpm
 e80e0468222a1d7c9514ffa17e827f7f  corporate/4.0/x86_64/xpdf-tools-3.02-0.2.20060mlcs4.x86_64.rpm 
 0dc34a5646041ead38fa548b6d077e30  corporate/4.0/SRPMS/xpdf-3.02-0.2.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJ9121mqjQ0CJFipgRAqovAKCMSsii64fdThApUudcr4IbnxnGJACgt9Vh
qgdM9ItadgxrhLua6l9zDP4=
=HcEM
-----END PGP SIGNATURE-----