app-text/xpdf: security version bump
authorAndrew Savchenko <bircoph@gentoo.org>
Thu, 21 Mar 2019 10:55:44 +0000 (13:55 +0300)
committerAndrew Savchenko <bircoph@gentoo.org>
Thu, 21 Mar 2019 11:00:31 +0000 (14:00 +0300)
commit6b695c59184713a18e2a7809f40088eff130afb6
treef734a1947b6e746773993f9a7a52ea50e902f825
parent3490d47f06758e7154e222e838a12e582570fa99
app-text/xpdf: security version bump

xpdf-4.01.01 fixes several vulnerabilities and problems reported by
Loginsoft, including CVE-2019-9589.

CVE-2019-9588 and CVE-2019-9587 are probably fixed as well, but it
is not clear from ChangeLog:

The PDFDoc(BaseStream) initializer wasn't working correctly.
Fixed a missing array bounds check in PSOutputDev.  [Thanks to
  Loginsoft for the bug report.]
    ^-- CVE-2019-9589
If the "U" string used for RC4 decryption is short, Adobe apparently
  zero-pads it, so Xpdf now does the same.
    ^-- Maybe CVE-2019-9588
Pdffonts now checks more carefully for loops between objects.
    ^-- Looks like CVE-2019-9587
Fixed a problem parsing large real numbers.  [Thanks to Loginsoft for
  the bug report.]

Bug: https://bugs.gentoo.org/681112
Bug: https://bugs.gentoo.org/681140
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Andrew Savchenko <bircoph@gentoo.org>
app-text/xpdf/Manifest
app-text/xpdf/xpdf-4.01.01.ebuild [new file with mode: 0644]