FEDORA-EPEL-2025-5b2095e2c2 — security update for xpdf

testing

xpdf-4.06-1.el8

FEDORA-EPEL-2025-5b2095e2c2 created by spot 6 months ago for Fedora EPEL 8

Update to 4.06. Lots of bugfixes, but notably, security fixes for the following CVEs:

CVE-2024-2971 CVE-2024-3247 CVE-2024-3248 CVE-2024-3900 CVE-2024-4141 CVE-2024-4568 CVE-2024-4976 CVE-2024-7866 CVE-2024-7867 CVE-2024-7868 CVE-2025-2574 CVE-2025-3154 CVE-2025-11896

This update has been submitted for testing by spot.

6 months ago

This update's test gating status has been changed to 'ignored'.

6 months ago

This update has been pushed to testing.

6 months ago

besser82 commented & provided feedback 6 months ago

karma

There are several consumer facing ABI changes in this build of xpdf-libs.

Bodhi is disabling automatic push to stable due to negative karma. The maintainer may push manually if they determine that the issue is not severe.

6 months ago

This update can be pushed to stable now if the maintainer wishes

6 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

low

Karma

-1

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Thresholds

Minimum Karma

Minimum Testing

7 days

Dates

submitted

6 months ago

in testing

6 months ago

approved

6 months ago

Builds

xpdf-4.06-1.el8

BZ#2271912 CVE-2024-2971 xpdf: negative object number in an indirect reference in a PDF file can cause an out-of-bounds array write [epel-all]

BZ#2272852 CVE-2024-3247 xpdf: stack-overflow in pdftotext [epel-all]

BZ#2272855 CVE-2024-3248 xpdf: stack overflow via pdftpng [epel-all]

BZ#2275828 CVE-2024-3900 xpdf: out-of-bounds array write [epel-all]

BZ#2277031 CVE-2024-4141 xpdf: Out-of-bounds array write [epel-all]

BZ#2279472 CVE-2024-4568 xpdf: loop in the PDF resources leads to infinite recursion [epel-8]

BZ#2280761 CVE-2024-4976 xpdf: Out-of-bounds array write due to missing object type check [epel-all]

BZ#2305299 CVE-2024-7868 xpdf: invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder [epel-8]

BZ#2305300 CVE-2024-7867 xpdf: integer overflow and divide-by-zero due to very large coordinates in a page box [epel-8]

BZ#2305305 CVE-2024-7866 xpdf: infinite recursion and a stack overflow due to PDF object loop in a pattern resource [epel-8]

BZ#2354012 CVE-2025-2574 xpdf: Out-of-bounds array write in Xpdf 4.05 due to incorrect integer overflow checking [epel-8]

BZ#2357054 CVE-2025-3154 xpdf: Out-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.05 [epel-8]

xpdf-4.06-1.el8

Automated Test Results

ignored