Bugzilla – Bug 58788
VUL-0: CVE-2004-0631: buffer overflow and shell meta character problem in acroread
Last modified: 2021-10-14 14:35:56 UTC
I assume you have already read this, but if this was not the case: http://idefense.com/application/poi/display?id=124&type=vulnerabilities http://idefense.com/application/poi/display?id=125&type=vulnerabilities
this is CAN-2004-0630 and CAN-2004-0631. The advisories state that 'the vendor appears to have silently fixed this vulnerability' and that 5.09 is not affected. We have 5.08 on most releases. Johannes do you know whether adobe has patched 5.08 already?
I have no information from Adobe. I will not touch any acroread package until bug 57092 is not solved.
*** Bug 58851 has been marked as a duplicate of this bug. ***
I want to mark that one can find at http://www.adobe.com/products/acrobat/readstep2.html the version 5.0.9. HEAD /pub/adobe/acrobatreader/unix/5.x/linux-509.tar.gz HTTP/1.1 Host: ardownload.adobe.com Last-Modified: Tue, 25 May 2004 00:13:30 GMT And in the advisitories, I find: "iDEFENSE has tested Adobe Acrobat Reader (UNIX) 5.0.9, which appears to be patched against this vulnerability."
We know about the newest version. We know where to get it. We know what iDEFENSE wrote. Nevertheless: Read my comment #2.
Johannes wants to say that we will need to clarify the license issues before doing any further updates.
Johannes, I think the problem here was, that external people are not allowed to read bug 57092.
Ah, yes, thanks to explain it!
<!-- SBZ_reopen -->Reopened by jsmeix@suse.de at Tue Aug 17 11:07:25 2004, took initial reporter rschiele@uni-mannheim.de to cc
Especially for acroread version 5.09 the license problem is solved, see http://bugzilla.suse.de/show_bug.cgi?id=42092#c19 Therefore I will now make security updates to version 5.09
Submitted acroread version 5.09 package to /work/src/done/ 8.1/acroread = SLES8/acroread = UL1/acroread 8.2/acroread 9.0/acroread 9.1/acroread = SLES9/acroread For me it is fixed. I reassign it to the security-team.
I submitted the patchinfo files. Will append them here for completeness.
Created attachment 22752 [details] patchinfo for box ...
Created attachment 22753 [details] patchinfo for maintained ...
According to /work/src/done/PATCHINFO/acroread.patch.maintained --------------------------------------------------------------------------- DISTRIBUTION: sles7-i386,sles8-slec-i386,sles9-i386,sles9-x86_64,ul1-i386 --------------------------------------------------------------------------- the security update should be made for SLES7 too and according to "is_maintained acroread" --------------------------------------------------------------------------- Package is on CD slos-1.0.i386 Distribution: sles7-i386 Distributionstring: SuSE-Linux-SLOS-i386 Marketing-Name: SuSE Linux Office Server --------------------------------------------------------------------------- it is really maintained for SLES7 but there is no directory for SLES7 under /work/src/done/ Therefore I don't know what to do regarding SLES7.
I think SLES7 isnt supported anymore no? So I will remove the sles7 entry from patchinfo.
yes, please remove it.
updates approved.
CVE-2004-0631: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)