A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-glibUpgrade poppler-demosUpgrade poppler-debuginfoUpgrade poppler-cpp-develUpgrade poppler-glib-develUpgrade poppler-cppUpgrade popplerUpgrade poppler-develUpgrade poppler-qtUpgrade poppler-qt-develUpgrade poppler-utils | Apr 27, 2020 | Feb 26, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 26, 2019 |
| Centos_linux | — | Upgrade evince-libsUpgrade okular-libsUpgrade poppler-utilsUpgrade evince-browser-pluginUpgrade poppler-demosUpgrade poppler-glib-debuginfoUpgrade evince-debuginfoUpgrade poppler-cpp-debuginfoUpgrade okular-develUpgrade poppler-qt-develUpgrade evince-nautilusUpgrade poppler-utils-debuginfoUpgrade poppler-develUpgrade poppler-qt5-debuginfoUpgrade poppler-cppUpgrade okular-debuginfoUpgrade poppler-glibUpgrade evince-dviUpgrade okular-partUpgrade evince-develUpgrade evinceUpgrade poppler-glib-develUpgrade poppler-cpp-develUpgrade poppler-debugsourceUpgrade okularUpgrade popplerUpgrade poppler-debuginfoUpgrade poppler-qt | Aug 28, 2019 | Feb 26, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler | Apr 2, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-utilsUpgrade poppler-glibUpgrade popplerUpgrade poppler-qt | May 7, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade popplerUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-qt | Apr 3, 2019 | Feb 26, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 26, 2019 |
| Oracle_linux | — | Upgrade poppler-qt5Upgrade okular-libsUpgrade poppler-utilsUpgrade poppler-develUpgrade poppler-demosUpgrade evince-nautilusUpgrade poppler-cppUpgrade evince-libsUpgrade poppler-qt-develUpgrade okular-partUpgrade poppler-qt5-develUpgrade okular-develUpgrade evince-develUpgrade poppler-glibUpgrade popplerUpgrade okularUpgrade evinceUpgrade poppler-qtUpgrade poppler-cpp-develUpgrade evince-dviUpgrade evince-browser-pluginUpgrade poppler-glib-devel | Jul 21, 2020 | Feb 25, 2019 |
| Redhat_linux | — | Upgrade evince-browser-pluginUpgrade evince-nautilusUpgrade poppler-cpp-develUpgrade poppler-glib-develUpgrade poppler-qt5-debuginfoUpgrade poppler-qtUpgrade poppler-qt-develUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5Upgrade evince-develUpgrade poppler-utilsUpgrade poppler-develUpgrade poppler-cppUpgrade evince-libsUpgrade poppler-qt5-develUpgrade evinceUpgrade poppler-glib-debuginfoUpgrade poppler-demosUpgrade okularUpgrade poppler-glibUpgrade poppler-debugsourceUpgrade okular-partUpgrade okular-libsUpgrade okular-develUpgrade poppler-debuginfoUpgrade popplerUpgrade poppler-utils-debuginfoUpgrade evince-debuginfoUpgrade evince-dviUpgrade okular-debuginfo | Aug 7, 2019 | Feb 26, 2019 |
| Suse | — | Upgrade libpoppler73Upgrade libpoppler73-32bitUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-cpp0Upgrade libpoppler-develUpgrade libpoppler-glib-develUpgrade libpoppler-glib8Upgrade poppler-tools | Dec 2, 2021 | Feb 26, 2019 |
| Ubuntu | — | Upgrade libpoppler58Upgrade poppler-utilsUpgrade libpoppler79Upgrade libpoppler44Upgrade libpoppler85Upgrade libpoppler73 | Mar 19, 2019 | Feb 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub