• ftp://ftp.foolabs.com/pub/xpdf/ (Download)
• ftp://gd.tuwien.ac.at/publishing/xpdf/ (Download)
• ftp://tug.org/xpdf/ (Download)
• ftp://ftp.openbsd.org/pub/OpenBSD/distfiles// (Download)
• ftp://ftp.usa.openbsd.org/pub/OpenBSD/distfiles// (Download)

• (2008-02-11) Updated to version: xpdf-3.02pl2p0
• (2007-11-09) Updated to version: xpdf-3.02pl2
• (2007-08-26) Updated to version: xpdf-3.02pl1p0
• (2007-08-01) Updated to version: xpdf-3.02pl1
• (2007-03-30) Updated to version: xpdf-3.02
• (2006-07-21) Package added to openports.se, version xpdf-3.01p1 (created)

Log message:
Tell configure to use -lm.
Fixes the detection of openmotif after the latest update.

Log message:
MFC:
This addresses the following security issues: CVE-2009-3603
CVE-2009-3604 CVE-2009-3605 CVE-2009-3606 CVE-2009-3608 CVE-2009-3609
Official patch from xpdf developers integrated into build.
from kili@, thanks!
ok jasper@

Log message:
update xpdf to 3.02.4. This addresses the following security issues:
CVE-2009-3603
CVE-2009-3604
CVE-2009-3605
CVE-2009-3606
CVE-2009-3608
CVE-2009-3609
Official patch from xpdf developers integrated into build.
OK kili@

Log message:
MFC:
SECURITY FIX
----------------------------
revision 1.65
date: 2009/05/30 22:35:56;  author: miod;  state: Exp;  lines: +2 -2
Fix possible out of bounds access in xpath code, reported upstream
----------------------------
revision 1.64
date: 2009/04/17 20:55:46;  author: kili;  state: Exp;  lines: +6 -5
SECURITY: update to xpdf-3.02pl3 which fixes multiple vulnerabilities.
See http://rhn.redhat.com/errata/RHSA-2009-0430.html for details.
----------------------------

Log message:
WANTLIB changes after xcb addition and bump.

Log message:
Fix possible out of bounds access in xpath code, reported upstream; bump
package name. ok kili@

Log message:
SECURITY: update to xpdf-3.02pl3 which fixes multiple vulnerabilities.
See http://rhn.redhat.com/errata/RHSA-2009-0430.html for details.
Also, fix license marker, update plists and simplify the pkgname
(dropping the pl, which seems to confuse bsd.port.mk's update
target).
ok naddy@, who had almost the same diff

Log message:
don't hardcode /usr/local and don't probe paths that don't exist on OpenBSD
ok steven@, kili@, landry@, sthen@

Log message:
Security fix for CVE-2008-1693. From Debian. diff from William Yodlowsky

Log message:
Security fix for CVE-2008-1693. From Debian.
ok naddy@

Log message:
Finally, fix make install (spotted by markus lude at gmx.de)
fix from sthen@
ok sthen@ steven@

Log message:
Finally, make xpdf MULTI_PACKAGES, xpdf -main package provides x-depending
parts of xpdf, and xpdf -utils provides non-x-depending parts (replacing the
no_x11 flavor). Appropriate @conflict marker makes upgrade flawless.
While here, remove dependency on a specific version of auto* (prompted by naddy@)
(and remember me to never _ever_ touch xpdf again)
Change requested by naddy@ espie@
ok sthen@ naddy@

Log message:
Add a no_x11 FLAVOR, based on an initial submission by Jeremy Evans
Discussed with many on ports@
ok brad@

Log message:
Update to xpdf-3.02pl2 which contains security fixes for CVE-2007-4352,
CVE-2007-5392 and CVE-2007-5393.
More info:
http://secunia.com/secunia_research/2007-88/advisory/
testing & ok simon@, jasper@

Log message:
fix ASCII85 encoding on LP64 archs

Log message:
MFC (original commit naddy@):
- SECURITY fix for CVE-2007-3387
ok sturm@

Log message:
MFC (original commit naddy@):
- SECURITY fix for CVE-2007-3387
ok sturm@

Log message:
SECURITY fix for CVE-2007-3387.
Also remove former maintainer at his request.
ok kili@

Log message:
MFC:
Update to xpdf 3.0.2, from Stuart Henderson and Brad Smith
Includes some security fixes

Log message:
more base64 checksums

Log message:
MFC:
Update to xpdf 3.0.2, from Stuart Henderson and Brad Smith
Includes some security fixes

Log message:
MFC:
Update to xpdf 3.0.2, from Stuart Henderson and Brad Smith
Includes some security fixes

Log message:
Forgot to cvs rm this one too. Pointed out by marco

Log message:
Update to xpdf 3.0.2, from Stuart Henderson and Brad Smith
Includes some security fixes
ok pvalchev, todd

Log message:
new lib specs

Log message:
MFC:
Fix heap based buffer overflow.
>From KDE. http://www.kde.org/info/security/advisory-20060202-1.txt

Log message:
MFC:
Fix heap based buffer overflow.
>From KDE. http://www.kde.org/info/security/advisory-20060202-1.txt

Log message:
Fix heap based buffer overflow.
>From KDE. http://www.kde.org/info/security/advisory-20060202-1.txt
ok brad@

Log message:
MFC:
Fix several security bugs in the xpdf code.
o iDefense advisories from 2005-12-05
o CAN-2005-3191, CAN-2005-3192, CAN-2005-3193
- JPX Stream Reader Heap Overflow Vulnerability
- DCTStream Baseline Heap Overflow Vulnerability
- DCTStream Progressive Heap Overflow
- StreamPredictor Heap Overflow Vulnerability
Patch provided by xpdf developers.

Log message:
MFC:
Fix several security bugs in the xpdf code.
o iDefense advisories from 2005-12-05
o CAN-2005-3191, CAN-2005-3192, CAN-2005-3193
- JPX Stream Reader Heap Overflow Vulnerability
- DCTStream Baseline Heap Overflow Vulnerability
- DCTStream Progressive Heap Overflow
- StreamPredictor Heap Overflow Vulnerability
Patch provided by xpdf developers.

Log message:
Fix several security bugs in the xpdf code.
o iDefense advisories from 2005-12-05
o CAN-2005-3191, CAN-2005-3192, CAN-2005-3193
- JPX Stream Reader Heap Overflow Vulnerability
- DCTStream Baseline Heap Overflow Vulnerability
- DCTStream Progressive Heap Overflow
- StreamPredictor Heap Overflow Vulnerability
Patch provided by xpdf developers.

Log message:
upgrade to xpdf 3.01
Most of the update is from Bernd Ahlers <bernd at ba-net dot org>

Log message:
bump PKGNAME so that 3.7 won't have higher PKGNAMEs than 3.8
suggested by espie@, ok pval@

Log message:
updated packages for these ports where not build in a sane environment
bump PKGNAME for fixed packages

Log message:
updated packages for these ports where not build in a sane environment
bump PKGNAME for fixed packages

Log message:
MFC:
Fix denial of service vulnerability.
Check sanity of the TrueType "loca" table.  Specially crafted broken
tables caused disk space exhaustion due to very large generated glyph
descriptions when attempting to fix the table.  CAN-2005-2097.
from Ubuntu Linux
ok brad@

Log message:
MFC:
Fix denial of service vulnerability.
Check sanity of the TrueType "loca" table.  Specially crafted broken
tables caused disk space exhaustion due to very large generated glyph
descriptions when attempting to fix the table.  CAN-2005-2097.
from Ubuntu Linux
ok brad@

Log message:
Fix denial of service vulnerability.
Check sanity of the TrueType "loca" table.  Specially crafted broken
tables caused disk space exhaustion due to very large generated glyph
descriptions when attempting to fix the table.  CAN-2005-2097.
from Ubuntu Linux; ok brad@

Log message:
sync patches

Log message:
SECURITY:
Fix a buffer overflow due to insufficient bounds checking while
processing a PDF file that provides malicious values in the /Encrypt
/Length tag.; bump PKGNAME
http://www.vuxml.org/openbsd/456f1b12-6a38-11d9-bc5d-00065bd5b0b6.html
ok brad@

Log message:
SECURITY:
Fix a buffer overflow due to insufficient bounds checking while
processing a PDF file that provides malicious values in the /Encrypt
/Length tag.
http://www.vuxml.org/openbsd/456f1b12-6a38-11d9-bc5d-00065bd5b0b6.html
ok brad@

Log message:
SECURITY:
Fix a buffer overflow due to insufficient bounds checking while
processing a PDF file that provides malicious values in the /Encrypt
/Length tag.
http://www.idefense.com/application/poi/display?id=186&type=vulnerabilities&flashstatus=false
ok robert@

Log message:
SIZE

Log message:
SECURITY:
fixed integer overflows:
http://www.vuxml.org/openbsd/d79a032a-2763-11d9-a0f4-00065bd5b0b6.html
fixed buffer overflow vulnerability:
http://www.vuxml.org/openbsd/9317ac06-5441-11d9-8ad2-00065bd5b0b6.html
ok brad@

Log message:
SECURITY:
fixed integer overflows:
http://www.vuxml.org/openbsd/d79a032a-2763-11d9-a0f4-00065bd5b0b6.html
fixed buffer overflow vulnerability:
http://www.vuxml.org/openbsd/9317ac06-5441-11d9-8ad2-00065bd5b0b6.html
ok brad@

Log message:
SECURITY:
fix a buffer overflow vulnerability; bump PKGNAME; use autoconf-2.59
ok MAINTAINER (brad@)

Log message:
Add WANTLIB markers

Log message:
Remove workaround for GNU m4 incompatibility, which has been fixed in our m4.

Log message:
freetype fixes, adapted from FreeBSD; ok brad@

Log message:
Chris Evans discovered numerous vulnerabilities in the xpdf package:
Multiple integer overflow issues affecting xpdf.
These can result in writing an arbitrary byte to an attacker controlled
location which probably could lead to arbitrary code execution.
CAN-2004-0888
Multiple integer overflow issues.
These can result in DoS or possibly arbitrary code execution.
CAN-2004-0889
Chris also discovered issues with infinite loop logic error.

Log message:
new plists

Log message:
drop obsolete lib requirement

Log message:
install sample xpdfrc file and fix lpr usage. From: sturm@

Log message:
FreeType2 authors are brain dead. Workaround really stupid change
with FreeType2 that comes with XF 4.4.

Log message:
now that there is a separate fonts package for ghostscript
use that instead.

Log message:
better

Log message:
- remove bogus --with-gzip in CONFIGURE_ARGS
- add RUN_DEPENDS on GNU ghostscript for the fonts

Log message:
upgrade to xpdf 3.00
"shitloads better rendering" - jose@

Log message:
remove WWW lines

Log message:
remove DRM bullshit.
--
From: cloder@

Log message:
The previous patch for the hyperlinks issue was not adequate. This update
fixes the patch.

Log message:
fixes a flaw where an attacker can embed malicious hyperlinks that if
activated can execute arbitrary shell commands.
http://marc.theaimsgroup.com/?l=full-disclosure&m=105555332025253&w=2

Log message:
MFC:
upgrade to xpdf 2.02pl1
fixes a flaw where an attacker can embed malicious hyperlinks that if
activated can execute arbitrary shell commands.
http://marc.theaimsgroup.com/?l=full-disclosure&m=105555332025253&w=2

Log message:
upgrade to xpdf 2.02pl1
fixes a flaw where an attacker can embed malicious hyperlinks that if
activated can execute arbitrary shell commands.
http://marc.theaimsgroup.com/?l=full-disclosure&m=105555332025253&w=2

Log message:
upgrade to xpdf 2.02
--
From: naddy@

Log message:
update to xpdf 2.01
- switch to motif toolkit
- support for multiple open documents
- lots of minor tweaks, bugfixes and additions, see
http://www.foolabs.com/xpdf/CHANGES for details
MAINTAINER ok

Log message:
MFC:
The pdftops filter in xpdf contains an integer overflow that can
be exploited to gain the privileges of the target user.
http://www.idefense.com/advisory/12.23.02.txt

Log message:
MFC:
The pdftops filter in xpdf contains an integer overflow that can
be exploited to gain the privileges of the target user.
http://www.idefense.com/advisory/12.23.02.txt

Log message:
The pdftops filter in xpdf contains an integer overflow that can
be exploited to gain the privileges of the target user.
http://www.idefense.com/advisory/12.23.02.txt

Log message:
No regression tests available.

Log message:
no more need to build this static on sparc64, remove workaround
ld.so fix thanks to drahn@