An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-glib-develUpgrade poppler-cppUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade poppler-utilsUpgrade poppler-qt-develUpgrade poppler-demosUpgrade poppler-debuginfoUpgrade poppler-develUpgrade poppler-glibUpgrade poppler | Apr 27, 2020 | Nov 7, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Nov 7, 2018 |
| Centos_linux | — | Upgrade okular-libsUpgrade poppler-debuginfoUpgrade poppler-develUpgrade evince-debuginfoUpgrade evinceUpgrade poppler-qt-develUpgrade okular-debuginfoUpgrade okularUpgrade okular-partUpgrade evince-dviUpgrade evince-libsUpgrade poppler-glibUpgrade evince-browser-pluginUpgrade poppler-demosUpgrade poppler-cppUpgrade evince-nautilusUpgrade poppler-qtUpgrade popplerUpgrade poppler-glib-develUpgrade poppler-utilsUpgrade okular-develUpgrade poppler-cpp-develUpgrade evince-devel | Aug 28, 2019 | Nov 7, 2018 |
| Debian | — | Upgrade poppler | Jul 30, 2024 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-glibUpgrade poppler-qtUpgrade poppler-utilsUpgrade poppler | Sep 16, 2021 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-utilsUpgrade poppler-glibUpgrade poppler-qtUpgrade poppler | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade popplerUpgrade poppler-glibUpgrade poppler-qtUpgrade poppler-utils | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade poppler-utilsUpgrade poppler-qtUpgrade popplerUpgrade poppler-glib | Feb 26, 2020 | Nov 7, 2018 |
| Oracle_linux | — | Upgrade okular-develUpgrade poppler-develUpgrade poppler-qtUpgrade poppler-qt-develUpgrade evinceUpgrade okular-partUpgrade evince-libsUpgrade poppler-cppUpgrade evince-develUpgrade okularUpgrade poppler-demosUpgrade poppler-cpp-develUpgrade evince-nautilusUpgrade evince-dviUpgrade poppler-utilsUpgrade evince-browser-pluginUpgrade poppler-glibUpgrade poppler-glib-develUpgrade popplerUpgrade okular-libs | Jul 21, 2020 | Nov 6, 2018 |
| Redhat_linux | — | Upgrade evince-libsUpgrade poppler-develUpgrade evince-nautilusUpgrade evince-debuginfoUpgrade poppler-cppUpgrade okular-develUpgrade poppler-qt-develUpgrade poppler-demosUpgrade okular-libsUpgrade poppler-utilsUpgrade okular-partUpgrade evince-develUpgrade okular-debuginfoUpgrade poppler-debuginfoUpgrade evince-browser-pluginUpgrade evinceUpgrade poppler-cpp-develUpgrade poppler-glibUpgrade okularUpgrade popplerUpgrade poppler-qtUpgrade evince-dviUpgrade poppler-glib-devel | Aug 7, 2019 | Nov 7, 2018 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-develUpgrade libpoppler-glib8Upgrade libpoppler-cpp0Upgrade libpoppler73-32bitUpgrade libpoppler-glib-develUpgrade libpoppler73Upgrade poppler-tools | Dec 2, 2021 | Nov 7, 2018 |
| Ubuntu | — | Upgrade libpoppler44Upgrade libpoppler79Upgrade libpoppler73Upgrade poppler-utilsUpgrade libpoppler58 | Dec 12, 2018 | Nov 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub