Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5102 > unrolled thread
| Started by | gwmfms06@unseen.is |
|---|---|
| First post | 2016-11-10 03:00 +0100 |
| Last post | 2016-11-13 17:30 +0100 |
| Articles | 6 — 5 participants |
Back to article view | Back to linux.debian.security
DSA-3708-1 mat -- security update (What are MAT users to do)? gwmfms06@unseen.is - 2016-11-10 03:00 +0100
Re: DSA-3708-1 mat -- security update (What are MAT users to do)? Andrew Deck <andrew.hastings.deck@gmail.com> - 2016-11-10 03:00 +0100
Re: DSA-3708-1 mat -- security update (What are MAT users to do)? intrigeri <intrigeri@debian.org> - 2016-11-10 09:10 +0100
Re: DSA-3708-1 mat -- security update (What are MAT users to do)? Robert Haist <rhaist@mailbox.org> - 2016-11-13 12:30 +0100
Re: DSA-3708-1 mat -- security update (What are MAT users to do)? intrigeri <intrigeri@debian.org> - 2016-11-13 13:50 +0100
Re: DSA-3708-1 mat -- security update (What are MAT users to do)? Stephen Dowdy <sdowdy@ucar.edu> - 2016-11-13 17:30 +0100
| From | gwmfms06@unseen.is |
|---|---|
| Date | 2016-11-10 03:00 +0100 |
| Subject | DSA-3708-1 mat -- security update (What are MAT users to do)? |
| Message-ID | <sBMOJ-7gR-1@gated-at.bofh.it> |
This email is in response to www.debian.org/security/2016/dsa-3708 I relied on MAT (Metadata Anonymisation Toolkit) on a daily basis to remove the metadata from PDFs as it is a requirement for my job. I must have this ability. I appreciate the effort to fix this bug but it was not a major issue for me because the PDFs I encounter did not have images. Now that MAT cannot deal with PDFs at all, I am forced to use Windows (which I hate) because I cannot find a suitable alternative to MAT. Can anyone please suggest a Debian solution to my current problem? I am assuming that Debian Stretch Stable (2017 release) will have an updated version of MAT that will again process PDFs? But what can I do until then to be able to meet my work demands?
[toc] | [next] | [standalone]
| From | Andrew Deck <andrew.hastings.deck@gmail.com> |
|---|---|
| Date | 2016-11-10 03:00 +0100 |
| Message-ID | <sBMOJ-7gR-13@gated-at.bofh.it> |
| In reply to | #5102 |
[Multipart message — attachments visible in raw view] — view raw
You can downgrade and version-pin the package and continue using the vulnerable version until a better version is released IFF you're sure the bug won't affect your use cases. On Nov 9, 2016 5:52 PM, <gwmfms06@unseen.is> wrote: > This email is in response to www.debian.org/security/2016/dsa-3708 > > I relied on MAT (Metadata Anonymisation Toolkit) on a daily basis to > remove the metadata from PDFs as it is a requirement for my job. I must > have this ability. I appreciate the effort to fix this bug but it was not a > major issue for me because the PDFs I encounter did not have images. Now > that MAT cannot deal with PDFs at all, I am forced to use Windows (which I > hate) because I cannot find a suitable alternative to MAT. > > Can anyone please suggest a Debian solution to my current problem? I am > assuming that Debian Stretch Stable (2017 release) will have an updated > version of MAT that will again process PDFs? But what can I do until then > to be able to meet my work demands? > >
[toc] | [prev] | [next] | [standalone]
| From | intrigeri <intrigeri@debian.org> |
|---|---|
| Date | 2016-11-10 09:10 +0100 |
| Message-ID | <sBSAN-2Uu-13@gated-at.bofh.it> |
| In reply to | #5102 |
Hi, gwmfms06@unseen.is: > This email is in response to www.debian.org/security/2016/dsa-3708 > I relied on MAT (Metadata Anonymisation Toolkit) on a daily basis to remove the > metadata from PDFs as it is a requirement for my job. I must have this ability. > I appreciate the effort to fix this bug but it was not a major issue for me because > the PDFs I encounter did not have images. Now that MAT cannot deal with PDFs at all, > I am forced to use Windows (which I hate) because I cannot find a suitable > alternative to MAT. I'm sorry about that. FYI this affects me as well as a lot of Tails users. > Can anyone please suggest a Debian solution to my current problem? I'm not aware of any :/ > I am assuming that Debian Stretch Stable (2017 release) will have an > updated version of MAT that will again process PDFs? This is unlikely, but who knows: perhaps someone will show up and contribute patches upstream (https://0xacab.org/mat/mat/issues/11067). Cheers, -- intrigeri
[toc] | [prev] | [next] | [standalone]
| From | Robert Haist <rhaist@mailbox.org> |
|---|---|
| Date | 2016-11-13 12:30 +0100 |
| Message-ID | <sD190-7Yp-21@gated-at.bofh.it> |
| In reply to | #5102 |
[Multipart message — attachments visible in raw view] — view raw
For PDFs you can use exiftool from the libimage-exiftool-perl to remove metadata: exiftool -all= example.pdf This works for me. Regards, Rob On 10.11.2016 02:42, gwmfms06@unseen.is wrote: > This email is in response to www.debian.org/security/2016/dsa-3708 > > I relied on MAT (Metadata Anonymisation Toolkit) on a daily basis to remove the metadata from PDFs as it is a requirement for my job. I must have this ability. I appreciate the effort to fix this bug but it was not a major issue for me because the PDFs I encounter did not have images. Now that MAT cannot deal with PDFs at all, I am forced to use Windows (which I hate) because I cannot find a suitable alternative to MAT. > > Can anyone please suggest a Debian solution to my current problem? I am assuming that Debian Stretch Stable (2017 release) will have an updated version of MAT that will again process PDFs? But what can I do until then to be able to meet my work demands? >
[toc] | [prev] | [next] | [standalone]
| From | intrigeri <intrigeri@debian.org> |
|---|---|
| Date | 2016-11-13 13:50 +0100 |
| Message-ID | <sD2oq-jd-5@gated-at.bofh.it> |
| In reply to | #5111 |
Robert Haist: > For PDFs you can use exiftool from the libimage-exiftool-perl to remove > metadata: > exiftool -all= example.pdf > This works for me. Does this address the problem (metadata in embedded images) that triggered us from removing this functionality from MAT?
[toc] | [prev] | [next] | [standalone]
| From | Stephen Dowdy <sdowdy@ucar.edu> |
|---|---|
| Date | 2016-11-13 17:30 +0100 |
| Message-ID | <sD5Pj-2Gi-23@gated-at.bofh.it> |
| In reply to | #5112 |
[Multipart message — attachments visible in raw view] — view raw
> On Sun, Nov 13, 2016 at 5:47 AM, intrigeri <intrigeri@debian.org> wrote: > Robert Haist: > > For PDFs you can use exiftool from the libimage-exiftool-perl to remove > > metadata: > > exiftool -all= example.pdf > > This works for me. > > Does this address the problem (metadata in embedded images) that > triggered us from removing this functionality from MAT? Assuming the documentation is correct, the manpage for exiftool states: > 3) Changes to PDF files are reversible because the original information is never actually deleted from the file. > So ExifTool alone may not be used to securely edit metadata in PDF files. that sounds like a "NO". :-( --stephen -- Stephen Dowdy - Systems Administrator - NCAR/RAL 303.497.2869 - sdowdy@ucar.edu - http://www.ral.ucar.edu/~sdowdy/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web