An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-cpp-develUpgrade poppler-cppUpgrade poppler-glib-develUpgrade poppler-qtUpgrade poppler-utilsUpgrade poppler-qt-develUpgrade poppler-glibUpgrade popplerUpgrade poppler-demosUpgrade poppler-develUpgrade poppler-debuginfo | Apr 27, 2020 | Nov 7, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Nov 7, 2018 |
| Centos_linux | — | Upgrade poppler-cppUpgrade poppler-glib-develUpgrade evince-browser-pluginUpgrade poppler-cpp-develUpgrade popplerUpgrade poppler-utilsUpgrade evince-develUpgrade okular-develUpgrade poppler-qtUpgrade evince-nautilusUpgrade poppler-demosUpgrade evince-debuginfoUpgrade poppler-glibUpgrade okularUpgrade poppler-debuginfoUpgrade okular-libsUpgrade evince-dviUpgrade poppler-develUpgrade okular-debuginfoUpgrade evinceUpgrade okular-partUpgrade poppler-qt-develUpgrade evince-libs | Aug 28, 2019 | Nov 7, 2018 |
| Debian | — | Upgrade poppler | Jul 30, 2024 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-qtUpgrade poppler | Sep 16, 2021 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-glibUpgrade poppler-qtUpgrade popplerUpgrade poppler-utils | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade popplerUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler-qt | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade popplerUpgrade poppler-glib | Feb 26, 2020 | Nov 7, 2018 |
| Oracle_linux | — | Upgrade evinceUpgrade okular-partUpgrade poppler-demosUpgrade evince-libsUpgrade poppler-qtUpgrade evince-develUpgrade poppler-cppUpgrade okularUpgrade poppler-qt-develUpgrade okular-develUpgrade poppler-develUpgrade poppler-glib-develUpgrade poppler-utilsUpgrade evince-nautilusUpgrade poppler-cpp-develUpgrade evince-browser-pluginUpgrade poppler-glibUpgrade evince-dviUpgrade popplerUpgrade okular-libs | Jul 21, 2020 | Nov 6, 2018 |
| Redhat_linux | — | Upgrade evinceUpgrade poppler-cpp-develUpgrade poppler-debuginfoUpgrade popplerUpgrade evince-dviUpgrade poppler-glibUpgrade poppler-glib-develUpgrade okular-partUpgrade evince-develUpgrade okularUpgrade poppler-qtUpgrade evince-browser-pluginUpgrade okular-debuginfoUpgrade poppler-utilsUpgrade poppler-develUpgrade evince-libsUpgrade poppler-cppUpgrade poppler-demosUpgrade okular-develUpgrade okular-libsUpgrade poppler-qt-develUpgrade evince-debuginfoUpgrade evince-nautilus | Aug 7, 2019 | Nov 7, 2018 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-glib8Upgrade libpoppler-develUpgrade libpoppler73-32bitUpgrade libpoppler-glib-develUpgrade libpoppler73Upgrade libpoppler-cpp0Upgrade poppler-tools | Dec 2, 2021 | Nov 7, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler79Upgrade libpoppler44Upgrade libpoppler73Upgrade poppler-utils | Dec 12, 2018 | Nov 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub