An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-utilsUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade poppler-glib-develUpgrade poppler-cppUpgrade poppler-develUpgrade poppler-demosUpgrade popplerUpgrade poppler-debuginfoUpgrade poppler-qt-develUpgrade poppler-glib | Apr 27, 2020 | Nov 7, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Nov 7, 2018 |
| Centos_linux | — | Upgrade poppler-utilsUpgrade evince-develUpgrade okular-develUpgrade poppler-cpp-develUpgrade popplerUpgrade poppler-qtUpgrade evince-nautilusUpgrade poppler-glib-develUpgrade poppler-cppUpgrade poppler-demosUpgrade evince-browser-pluginUpgrade poppler-debuginfoUpgrade evince-debuginfoUpgrade poppler-glibUpgrade okular-libsUpgrade okular-debuginfoUpgrade poppler-develUpgrade okularUpgrade evince-libsUpgrade evince-dviUpgrade evinceUpgrade okular-partUpgrade poppler-qt-devel | Aug 28, 2019 | Nov 7, 2018 |
| Debian | — | Upgrade poppler | Jul 30, 2024 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler | Sep 16, 2021 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-glibUpgrade poppler-qtUpgrade popplerUpgrade poppler-utils | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-glibUpgrade poppler-qtUpgrade poppler-utilsUpgrade poppler | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade poppler-glibUpgrade popplerUpgrade poppler-utilsUpgrade poppler-qt | Feb 26, 2020 | Nov 7, 2018 |
| Oracle_linux | — | Upgrade okular-libsUpgrade evince-browser-pluginUpgrade poppler-glib-develUpgrade poppler-glibUpgrade poppler-utilsUpgrade evince-dviUpgrade popplerUpgrade poppler-cpp-develUpgrade evince-nautilusUpgrade evince-develUpgrade evince-libsUpgrade evinceUpgrade poppler-qtUpgrade okular-partUpgrade okularUpgrade poppler-cppUpgrade poppler-demosUpgrade okular-develUpgrade poppler-develUpgrade poppler-qt-devel | Jul 21, 2020 | Nov 6, 2018 |
| Redhat_linux | — | Upgrade poppler-cpp-develUpgrade popplerUpgrade okular-partUpgrade evince-dviUpgrade poppler-debuginfoUpgrade poppler-qtUpgrade evinceUpgrade okularUpgrade poppler-glibUpgrade evince-develUpgrade evince-browser-pluginUpgrade okular-debuginfoUpgrade poppler-glib-develUpgrade evince-nautilusUpgrade poppler-utilsUpgrade poppler-cppUpgrade evince-debuginfoUpgrade okular-libsUpgrade okular-develUpgrade poppler-demosUpgrade poppler-develUpgrade evince-libsUpgrade poppler-qt-devel | Aug 7, 2019 | Nov 7, 2018 |
| Suse | — | Upgrade libpoppler-glib-develUpgrade libpoppler73Upgrade libpoppler-cpp0Upgrade poppler-toolsUpgrade libpoppler73-32bitUpgrade libpoppler-develUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-glib8 | Dec 2, 2021 | Nov 7, 2018 |
| Ubuntu | — | Upgrade poppler-utilsUpgrade libpoppler79Upgrade libpoppler73Upgrade libpoppler44Upgrade libpoppler58 | Dec 12, 2018 | Nov 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub