--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-352a65d3bc
2021-05-27 00:40:35.572834
--------------------------------------------------------------------------------
Name : djvulibre
Product : Fedora EPEL 7
Version : 3.5.25.3
Release : 23.el7
URL :
http://djvu.sourceforge.net/
Summary : DjVu viewers, encoders, and utilities
Description :
DjVu is a web-centric format and software platform for distributing documents
and images. DjVu can advantageously replace PDF, PS, TIFF, JPEG, and GIF for
distributing scanned documents, digital documents, or high-resolution pictures.
DjVu content downloads faster, displays and renders faster, looks nicer on a
screen, and consume less client resources than competing formats. DjVu images
display instantly and can be smoothly zoomed and panned with no lengthy
re-rendering.
DjVuLibre is a free (GPL'ed) implementation of DjVu, including viewers,
decoders, simple encoders, and utilities. The browser plugin is in its own
separate sub-package.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2021-3500, CVE-2021-32490, CVE-2021-32491, CVE-2021-32492
and CVE-2021-32493.
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 11 2021 Marek Kasik <mkasik(a)redhat.com> - 3.5.25.3-23
- Avoid unsigned short overflow in GBitmap when allocating row buffer
- Resolves: #1958181
* Tue May 11 2021 Marek Kasik <mkasik(a)redhat.com> - 3.5.25.3-22
- Avoid stack overflow in DjVuPort by remembering which file we are opening
- Resolves: #1958164
* Tue May 11 2021 Marek Kasik <mkasik(a)redhat.com> - 3.5.25.3-21
- Check input pool for NULL
- Resolves: #1958179
* Tue May 11 2021 Marek Kasik <mkasik(a)redhat.com> - 3.5.25.3-20
- Avoid integer overflow when allocating bitmap
- Resolves: #1958177
* Tue May 11 2021 Marek Kasik <mkasik(a)redhat.com> - 3.5.25.3-19
- Check image size for 0
- Resolves: #1958171
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1943684 - CVE-2021-32491 djvulibre: Integer overflow in function render() in
tools/ddjvu via crafted djvu file
https://bugzilla.redhat.com/show_bug.cgi?id=1943684
[ 2 ] Bug #1943685 - CVE-2021-3500 djvulibre: Stack overflow in function
DJVU::DjVuDocument::get_djvu_file() via crafted djvu file
https://bugzilla.redhat.com/show_bug.cgi?id=1943685
[ 3 ] Bug #1943686 - CVE-2021-32492 djvulibre: Out of bounds read in function
DJVU::DataPool::has_data() via crafted djvu file
https://bugzilla.redhat.com/show_bug.cgi?id=1943686
[ 4 ] Bug #1943690 - CVE-2021-32493 djvulibre: Heap buffer overflow in function
DJVU::GBitmap::decode() via crafted djvu file
https://bugzilla.redhat.com/show_bug.cgi?id=1943690
[ 5 ] Bug #1943693 - CVE-2021-32490 djvulibre: Out of bounds write in function
DJVU::filter_bv() via crafted djvu file
https://bugzilla.redhat.com/show_bug.cgi?id=1943693
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update djvulibre' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------