Arch Linux

Description:
xpdf use the same codebase as poppler, just slightly diverged. Poppler package
has been fixed, but xpdf not.

"An insufficient escape sequences sanitization flaw was found in the way xpdf, a
PDF file viewer for the X window system, performed sanitization of certain
characters to be displayed in the error messages, which arose during presentation
of certain PDF files. A remote attacker could use this flaw to modify a window's
title, or, possibly execute arbitrary commands or overwrite files, via a
specially-crafted PDF file containing an escape sequence for a terminal
emulator if local, unsuspecting user opened such crafted PDF file in xpdf."


Redhat buzilla entry : https://bugzilla.redhat.com/show_bug.cgi?id=789936
oss-sec thread : http://www.openwall.com/lists/oss-security/2013/08/11/1


Patch (from oss-sec):
http://sourceforge.net/projects/miscellaneouspa/postdownload?source=dlp
This code was adapted from the Poppler project fix.

Not tested.