An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-demosUpgrade poppler-qt-develUpgrade poppler-glibUpgrade poppler-debuginfoUpgrade poppler-develUpgrade popplerUpgrade poppler-cppUpgrade poppler-qtUpgrade poppler-utilsUpgrade poppler-cpp-develUpgrade poppler-glib-devel | Apr 27, 2020 | Nov 7, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Nov 7, 2018 |
| Centos_linux | — | Upgrade poppler-cppUpgrade evince-develUpgrade poppler-cpp-develUpgrade evince-browser-pluginUpgrade popplerUpgrade poppler-demosUpgrade okular-develUpgrade poppler-glib-develUpgrade evince-nautilusUpgrade poppler-utilsUpgrade poppler-qtUpgrade poppler-debuginfoUpgrade evince-dviUpgrade poppler-qt-develUpgrade okular-debuginfoUpgrade okularUpgrade okular-partUpgrade evinceUpgrade poppler-glibUpgrade poppler-develUpgrade evince-debuginfoUpgrade evince-libsUpgrade okular-libs | Aug 28, 2019 | Nov 7, 2018 |
| Debian | — | Upgrade poppler | Jul 30, 2024 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-utilsUpgrade poppler-glibUpgrade poppler-qtUpgrade poppler | Sep 16, 2021 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-qtUpgrade poppler-glibUpgrade popplerUpgrade poppler-utils | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler | Nov 19, 2019 | Nov 7, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade popplerUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-qt | Feb 26, 2020 | Nov 7, 2018 |
| Oracle_linux | — | Upgrade evince-dviUpgrade poppler-cpp-develUpgrade evince-nautilusUpgrade poppler-glib-develUpgrade poppler-utilsUpgrade poppler-glibUpgrade evince-browser-pluginUpgrade okular-libsUpgrade popplerUpgrade poppler-demosUpgrade evince-libsUpgrade poppler-qtUpgrade okular-develUpgrade poppler-develUpgrade evince-develUpgrade okularUpgrade poppler-qt-develUpgrade evinceUpgrade okular-partUpgrade poppler-cpp | Jul 21, 2020 | Nov 6, 2018 |
| Redhat_linux | — | Upgrade okular-develUpgrade poppler-demosUpgrade poppler-develUpgrade poppler-cppUpgrade evince-debuginfoUpgrade poppler-qt-develUpgrade okular-libsUpgrade poppler-utilsUpgrade evince-nautilusUpgrade evince-libsUpgrade poppler-glib-develUpgrade poppler-debuginfoUpgrade evince-dviUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade okular-debuginfoUpgrade evince-browser-pluginUpgrade poppler-glibUpgrade okularUpgrade evince-develUpgrade okular-partUpgrade popplerUpgrade evince | Aug 7, 2019 | Nov 7, 2018 |
| Suse | — | Upgrade libpoppler-glib-develUpgrade libpoppler73-32bitUpgrade poppler-toolsUpgrade libpoppler73Upgrade libpoppler-cpp0Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-develUpgrade libpoppler-glib8 | Dec 2, 2021 | Nov 7, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler79Upgrade libpoppler73Upgrade libpoppler44Upgrade poppler-utils | Dec 12, 2018 | Nov 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub