Security update for qpdf


This version update for qpdf to 7.1.1 fixes the following issues:

- Update to version 7.1.1

* Fix one linearization bug affecting files whose first /ID component is not 16 bytes long

- Update to version 7.1.0

* Allow raw encryption key to be specified in libary and command
line with the QPDF::setPasswordIsHexKey method and
--password-is-hex-key option. Allow encryption key to be displayed
with --show-encryption-key option. See
https://blog.didierstevens.com/2017/12/28/cracking-encrypted-pdfs-part-3/
for a discussion of using this for cracking encrypted PDFs. I hope
that a future release of qpdf will include some additional
recovery options that may also make use of this capability.
* Fix lexical error: the PDF specification allows floating point
numbers to end with "."
* Fix link order in the build to avoid conflicts when building
from source while an older version of qpdf is installed
* Add support for TIFF predictor for LZW and Flate streams. Now
* Clarify documentation around options that control parsing but
not output creation. Two options: --suppress-recovery and
--ignore-xref-streams, were documented in the "Advanced
Transformation Options" section of the manual and --help output
even though they are not related to output. These are now
described in a separate section called "Advanced Parsing Options."
* Implement remaining PNG filters for decode. Prior versions could
decode only the "up" filter. Now all PNG filters (sub, up,
average, Paeth, optimal) are supported for decoding.
The implementation of the remaining PNG filters changed the
interface to the private Pl_PNGFilter class, but this class's
header file is not in the installation, and there is no public
interface to the class. Within the library, the class is never
allocated on the stack; it is only ever dynamically allocated. As
such, this does not actually break binary compatibility of the
library. all predictor functions are supported

- Update to version 7.0.0

* License is now Apache-2.0
* Add new libjpeg8-devel dependency
* Improve the error message that is issued when QPDFWriter encounters
a stream that can't be decoded. In particular, mention that the stream
will be copied without filtering to avoid data loss.
* Add new methods to the C API to correspond to new additions to QPDFWriter:

- qpdf_set_compress_streams
- qpdf_set_decode_level
- qpdf_set_preserve_unreferenced_objects
- qpdf_set_newline_before_endstream
* Add support for writing PCLm files
* QPDF now supports reading and writing streams encoded with
JPEG or RunLength encoding. Library API enhancements and
command-line options have been added to control this
behavior. See command-line options --compress-streams
and --decode-level and methods QPDFWriter::setCompressStreams
and QPDFWriter::setDecodeLevel.
* Page rotation is now supported and accessible from both the
library and the command line.
* Fixes CVE-2017-12595 boo#1055960, CVE-2017-9208 boo#1040311
CVE-2017-9209 boo#1040312, CVE-2017-9210 boo#1040313,
CVE-2017-11627 boo#1050577, CVE-2017-11626 boo#1050578,
CVE-2017-11625 boo#1050579, CVE-2017-11624 boo#1050581

- Update to version 6.0.0

* Bump shared library version since 5.2.0 broke ABI.

- Update to version 5.2.0

* Support for deterministic /IDs for non-encrypted files. This is off by default.
* Handle more invalid xref tables

Fixed bugs
bnc#1050577
VUL-1: CVE-2017-11627: qpdf: A stack-consumption vulnerability which allows attackers to cause DoS
bnc#1050579
VUL-1: CVE-2017-11625: qpdf: A stack-consumption vulnerability which allows attackers to cause DoS
bnc#1050578
VUL-1: CVE-2017-11626: qpdf: A stack-consumption vulnerability which allows attackers to cause DoS
bnc#1050581
VUL-1: CVE-2017-11624: qpdf: A stack-consumption vulnerability which allows attackers to cause DoS
bnc#1055960
VUL-0: CVE-2017-12595: qpdf: Stack overflow when processing deeply nested arrays and dictionaries
bnc#1040312
VUL-1: CVE-2017-9209: qpdf: libqpdf.a allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document
bnc#1040313
VUL-1: CVE-2017-9210: qpdf: libqpdf.a allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document
bnc#1040311
VUL-1: CVE-2017-9208: qpdf: libqpdf.a allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document
Selected Binaries
openSUSE Build Service is sponsored by