Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 2 Jun 2016 10:33:28 +0000
From: Holger Levsen <>
Subject: CVE request: mat doesn't remove metadata in embedded images in PDFs

explains how mat fails to do what it's supposed to do, namely removing
embedded meta data. The bug is that it doesnt remove metadata from images
embedded in PDFs (while it does remove metadata from PDFs and from

So basically the core feature of mat is partly broken :/ So I think this
warrants a CVE as IMHO this ain't just a missing feature and folks on
the #debian-security IRC channel agreed.

This issue is being tracked by it's developers as and in Debian as and affects all versions of mat and is
not fixed anywhere yet.

Could a CVE please be assigned to this issue?
Also I wonder if similar bugs happen with other recursive formats, like an
OpenDocument text embedding an image or embedding a pdf embedding an
image or a zip file containing a zip file containing a .odt file
containing an pdf containing an image…

	Holger (not subscribed to the list, please cc: me on replies.)

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.