XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-qt-develUpgrade poppler-cppUpgrade poppler-glibUpgrade poppler-debuginfoUpgrade popplerUpgrade poppler-demosUpgrade poppler-cpp-develUpgrade poppler-utilsUpgrade poppler-develUpgrade poppler-glib-develUpgrade poppler-qt | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade poppler-debuginfoUpgrade poppler-qt-develUpgrade okular-develUpgrade poppler-debugsourceUpgrade okular-debuginfoUpgrade evince-libsUpgrade poppler-cpp-debuginfoUpgrade evince-develUpgrade poppler-demosUpgrade poppler-qtUpgrade poppler-develUpgrade poppler-qt5-debuginfoUpgrade poppler-cpp-develUpgrade poppler-utilsUpgrade okular-partUpgrade evince-nautilusUpgrade evince-debuginfoUpgrade poppler-utils-debuginfoUpgrade evince-dviUpgrade evince-browser-pluginUpgrade poppler-glib-develUpgrade okular-libsUpgrade evinceUpgrade poppler-cppUpgrade popplerUpgrade poppler-glibUpgrade poppler-glib-debuginfoUpgrade okular | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-helpUpgrade popplerUpgrade poppler-cpp | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade poppler-qt-develUpgrade okular-partUpgrade evince-nautilusUpgrade poppler-qt5Upgrade poppler-qt5-develUpgrade poppler-demosUpgrade poppler-utilsUpgrade poppler-glib-develUpgrade okular-develUpgrade poppler-develUpgrade evince-develUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade evince-libsUpgrade evince-dviUpgrade poppler-cppUpgrade okularUpgrade evinceUpgrade poppler-glibUpgrade okular-libsUpgrade popplerUpgrade evince-browser-plugin | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade poppler-glib-debuginfoUpgrade poppler-qtUpgrade okular-partUpgrade poppler-qt5-develUpgrade poppler-utils-debuginfoUpgrade poppler-qt-develUpgrade popplerUpgrade evinceUpgrade poppler-glib-develUpgrade poppler-utilsUpgrade evince-develUpgrade poppler-cppUpgrade poppler-cpp-develNo solution existsUpgrade poppler-qt5Upgrade poppler-develUpgrade evince-debuginfoUpgrade poppler-debuginfoUpgrade poppler-debugsourceUpgrade evince-browser-pluginUpgrade evince-nautilusUpgrade evince-dviUpgrade poppler-cpp-debuginfoUpgrade okular-develUpgrade evince-libsUpgrade poppler-qt5-debuginfoUpgrade poppler-glibUpgrade okular-libsUpgrade okularUpgrade okular-debuginfoUpgrade poppler-demos | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade libpoppler73Upgrade poppler-toolsUpgrade libpoppler-glib-develUpgrade libpoppler-cpp0Upgrade libpoppler-develUpgrade libpoppler-glib8Upgrade libpoppler73-32bitUpgrade typelib-1_0-Poppler-0_18 | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade poppler-utilsUpgrade libpoppler73Upgrade libpoppler44Upgrade libpoppler79 | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub