Gentoo alert 202405-33 (PoDoFo)
| From: | glsamaker@gentoo.org | |
| To: | gentoo-announce@lists.gentoo.org | |
| Subject: | [gentoo-announce] [ GLSA 202405-33 ] PoDoFo: Multiple Vulnerabilities | |
| Date: | Sun, 12 May 2024 05:25:38 -0000 | |
| Message-ID: | <171549153882.8.863840777305474998@987c7955d8b1> |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202405-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: PoDoFo: Multiple Vulnerabilities Date: May 12, 2024 Bugs: #906105 ID: 202405-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in PoDoFo, the worst of which could lead to code execution. Background ========== PoDoFo is a free portable C++ library to work with the PDF file format. Affected packages ================= Package Vulnerable Unaffected --------------- ------------ ------------ app-text/podofo < 0.10.1 >= 0.10.1 Description =========== Please review the referenced CVE identifiers for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All PoDoFo users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-text/podofo-0.10.1" References ========== [ 1 ] CVE-2023-31566 https://nvd.nist.gov/vuln/detail/CVE-2023-31566 [ 2 ] CVE-2023-31567 https://nvd.nist.gov/vuln/detail/CVE-2023-31567 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202405-33 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmZAUtIACgkQFMQkOaVy +9m9kBAAhPnimi2CjBwlB1dMAEW/c90HIcZspEVvz0aoloYLVDCtPXfmBcI/npMS FHFmvngIhBiSHderEtVLTV6EldblLLF3Qg60MS4cEKYZlmSr/H9xN/BHep38+bMk AnJihukO7WCIEXXKd67K43a/WeP/ymzYVEh2I4hRZb7Egkc1ns0hWYY1gT/Sn8qn 61pvd1ugYhyurGf2O8gYYRNtLXjU1mLCDatU+qcrAtl9IGfKvx4+zbwSQzBYUCwd Exq5XXhLaZOuVdbBXj+tCg2U2uGyUNLKXvw6C63nZ9DkyN5j55MisXsYOkZN7Ulk KrMoGg7ywubNw0nWEexdZlYo5WQ8JZ8cDXCl88o2lZ/zmKC12fqnUMg+0A9Ey891 yaMm6jExL34FofHgomP8FNpJuJYLnplNnbOapEN7xX/pF+Uv61uLHRYmdIBAcQ/j jcpqP1zAeRETcbLFpUvEg2175xgC9NSkvEFmLtUwctqb0WVAwSSpregvXxNLPasO VxRbTAjn70OBMifUwJjGOu86U5QKutkBYoYUKi8HcW0hkPbqC0jj325npqCzGyKQ w/3wDPxHvjvhcN1uFQRPaRdMon0hnU7p0uAr09IubZY68/Z+ZLPPoXLBg2QUWqxw lNQ5oNQWcYuKFpAus4bmYLY3vG37rI4+VugEqhg6NGEU6n/Pad4= =h5SP -----END PGP SIGNATURE-----