Debian Security Advisory

DSA-2844-1 djvulibre -- arbitrary code execution

Date Reported:
15 Jan 2014
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2012-6535.
More information:

It was discovered that djvulibre, the Open Source DjVu implementation project, can be crashed or possibly make it execute arbitrary code when processing a specially crafted djvu file.

For the oldstable distribution (squeeze), this problem has been fixed in version 3.5.23-3+squeeze1.

This problem has been fixed before the release of the stable distribution (wheezy), therefore it is not affected.

We recommend that you upgrade your djvulibre packages.