XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-qtUpgrade poppler-glib-develUpgrade poppler-demosUpgrade poppler-utilsUpgrade poppler-cpp-develUpgrade poppler-develUpgrade poppler-qt-develUpgrade poppler-glibUpgrade poppler-cppUpgrade poppler-debuginfoUpgrade poppler | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade evince-develUpgrade poppler-utilsUpgrade poppler-cpp-debuginfoUpgrade poppler-develUpgrade evince-nautilusUpgrade poppler-qt5-debuginfoUpgrade okular-partUpgrade poppler-cpp-develUpgrade evince-debuginfoUpgrade poppler-debuginfoUpgrade poppler-qt-develUpgrade okular-develUpgrade poppler-debugsourceUpgrade okular-debuginfoUpgrade evince-libsUpgrade poppler-demosUpgrade poppler-utils-debuginfoUpgrade poppler-qtUpgrade popplerUpgrade poppler-glib-debuginfoUpgrade okular-libsUpgrade poppler-glib-develUpgrade evince-browser-pluginUpgrade evince-dviUpgrade okularUpgrade poppler-cppUpgrade poppler-glibUpgrade evince | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-cppUpgrade popplerUpgrade poppler-help | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade okular-partUpgrade evince-develUpgrade poppler-glib-develUpgrade poppler-cpp-develUpgrade poppler-utilsUpgrade poppler-qtUpgrade poppler-qt-develUpgrade okular-develUpgrade poppler-qt5-develUpgrade poppler-demosUpgrade poppler-qt5Upgrade poppler-develUpgrade evince-nautilusUpgrade evince-libsUpgrade evince-dviUpgrade evinceUpgrade okularUpgrade okular-libsUpgrade evince-browser-pluginUpgrade popplerUpgrade poppler-glibUpgrade poppler-cpp | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade poppler-qt5-debuginfoUpgrade okular-develUpgrade poppler-cpp-debuginfoUpgrade evince-libsUpgrade poppler-glibUpgrade evince-nautilusUpgrade poppler-debuginfoUpgrade okularUpgrade okular-libsUpgrade okular-debuginfoUpgrade poppler-demosUpgrade evince-dviUpgrade poppler-debugsourceUpgrade evince-browser-pluginUpgrade evince-debuginfoUpgrade evinceUpgrade poppler-utils-debuginfoUpgrade poppler-qt5Upgrade poppler-qt5-develUpgrade poppler-glib-debuginfoUpgrade okular-partUpgrade poppler-qtUpgrade popplerUpgrade poppler-qt-develUpgrade poppler-glib-develUpgrade poppler-cppUpgrade evince-develNo solution existsUpgrade poppler-utilsUpgrade poppler-develUpgrade poppler-cpp-devel | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade libpoppler-develUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade libpoppler-glib8Upgrade libpoppler-cpp0Upgrade libpoppler73Upgrade poppler-toolsUpgrade libpoppler-glib-devel | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler79Upgrade libpoppler73Upgrade libpoppler44Upgrade poppler-utils | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub