Re: Re: [CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the error message {AKA request for feedback if CVE to be marked as disputed / rejected}

[Michael Gilbert <mgilbert () debian org>]

On Mon, Aug 12, 2013 at 4:22 PM, Kurt Seifried wrote:
> I assume we'll SPLIT this? In past some xpdf/poppler issues have been
> merged circa 2010, but after that they appear to have been usually
> treated as separate:
>
> http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=poppler
> http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=xpdf

It's the same codebase, just slightly diverged, so I would argue no.
In fact Debian's xpdf is unaffected once poppler is fixed since it
links against it (and the issue is in poppler's Error.cc).  I believe
Gentoo does the same.

Best wishes,
Mike