XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade popplerUpgrade poppler-debuginfoUpgrade poppler-qt-develUpgrade poppler-cppUpgrade poppler-glibUpgrade poppler-glib-develUpgrade poppler-qtUpgrade poppler-develUpgrade poppler-demosUpgrade poppler-utilsUpgrade poppler-cpp-devel | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade poppler-demosUpgrade poppler-debuginfoUpgrade poppler-utilsUpgrade poppler-utils-debuginfoUpgrade evince-debuginfoUpgrade okular-partUpgrade evince-develUpgrade poppler-cpp-debuginfoUpgrade poppler-qt-develUpgrade okular-develUpgrade okular-debuginfoUpgrade evince-libsUpgrade poppler-cpp-develUpgrade poppler-debugsourceUpgrade poppler-develUpgrade evince-nautilusUpgrade poppler-qt5-debuginfoUpgrade poppler-qtUpgrade evince-browser-pluginUpgrade evinceUpgrade evince-dviUpgrade okularUpgrade poppler-glib-develUpgrade poppler-cppUpgrade popplerUpgrade poppler-glibUpgrade poppler-glib-debuginfoUpgrade okular-libs | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-cppUpgrade popplerUpgrade poppler-help | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade popplerUpgrade evince-libsUpgrade evince-browser-pluginUpgrade okular-libsUpgrade evince-dviUpgrade evinceUpgrade poppler-cppUpgrade okularUpgrade poppler-glibUpgrade poppler-qt-develUpgrade poppler-qt5-develUpgrade poppler-utilsUpgrade evince-develUpgrade poppler-qt5Upgrade poppler-demosUpgrade poppler-cpp-develUpgrade evince-nautilusUpgrade okular-develUpgrade poppler-glib-develUpgrade poppler-develUpgrade poppler-qtUpgrade okular-part | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade poppler-demosUpgrade okular-libsUpgrade poppler-debuginfoUpgrade okular-debuginfoUpgrade evince-nautilusUpgrade okularUpgrade evince-libsUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5-debuginfoUpgrade okular-develUpgrade poppler-glibUpgrade evince-browser-pluginUpgrade evince-dviUpgrade poppler-debugsourceUpgrade poppler-cppUpgrade poppler-utils-debuginfoUpgrade evince-debuginfoUpgrade poppler-glib-debuginfoUpgrade poppler-utilsUpgrade poppler-qtUpgrade poppler-qt-develUpgrade poppler-qt5Upgrade poppler-cpp-develUpgrade poppler-glib-develUpgrade poppler-qt5-develUpgrade popplerUpgrade poppler-develUpgrade evince-develNo solution existsUpgrade okular-partUpgrade evince | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade libpoppler73Upgrade libpoppler-glib-develUpgrade poppler-toolsUpgrade libpoppler-cpp0Upgrade libpoppler-develUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade libpoppler-glib8 | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler73Upgrade libpoppler79Upgrade libpoppler44Upgrade poppler-utilsUpgrade libpoppler58 | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub