XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-demosUpgrade poppler-utilsUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade poppler-glib-develUpgrade poppler-develUpgrade poppler-qt-develUpgrade poppler-cppUpgrade popplerUpgrade poppler-glibUpgrade poppler-debuginfo | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade poppler-cppUpgrade poppler-glib-develUpgrade okularUpgrade poppler-glibUpgrade popplerUpgrade evince-browser-pluginUpgrade evince-dviUpgrade okular-libsUpgrade evinceUpgrade poppler-glib-debuginfoUpgrade poppler-utilsUpgrade evince-develUpgrade evince-libsUpgrade poppler-develUpgrade okular-develUpgrade poppler-qtUpgrade okular-partUpgrade poppler-qt5-debuginfoUpgrade poppler-cpp-debuginfoUpgrade poppler-demosUpgrade poppler-qt-develUpgrade poppler-utils-debuginfoUpgrade evince-debuginfoUpgrade poppler-debugsourceUpgrade poppler-cpp-develUpgrade evince-nautilusUpgrade poppler-debuginfoUpgrade okular-debuginfo | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-cppUpgrade poppler-helpUpgrade poppler | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade poppler-qt5-develUpgrade okular-partUpgrade poppler-qt-develUpgrade poppler-utilsUpgrade evince-develUpgrade poppler-qtUpgrade poppler-glib-develUpgrade poppler-cpp-develUpgrade poppler-demosUpgrade evince-nautilusUpgrade okular-develUpgrade poppler-qt5Upgrade poppler-develUpgrade evinceUpgrade poppler-glibUpgrade okular-libsUpgrade evince-browser-pluginUpgrade evince-libsUpgrade popplerUpgrade poppler-cppUpgrade evince-dviUpgrade okular | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade poppler-debuginfoUpgrade poppler-qt5-debuginfoUpgrade poppler-glibUpgrade evince-nautilusUpgrade poppler-demosUpgrade poppler-debugsourceUpgrade okularUpgrade okular-develUpgrade okular-debuginfoUpgrade poppler-cpp-debuginfoUpgrade evince-dviUpgrade okular-libsUpgrade evince-browser-pluginUpgrade evince-libsUpgrade poppler-utils-debuginfoUpgrade poppler-glib-debuginfoUpgrade poppler-cppUpgrade evince-debuginfoUpgrade evince-develUpgrade poppler-cpp-develUpgrade poppler-qt5Upgrade poppler-develUpgrade poppler-qt-develUpgrade okular-partUpgrade poppler-qtUpgrade poppler-utilsUpgrade popplerUpgrade poppler-glib-develUpgrade poppler-qt5-develUpgrade evinceNo solution exists | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade libpoppler-glib8Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-develUpgrade libpoppler73-32bitUpgrade poppler-toolsUpgrade libpoppler73Upgrade libpoppler-cpp0Upgrade libpoppler-glib-devel | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler44Upgrade poppler-utilsUpgrade libpoppler73Upgrade libpoppler79 | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub