XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-develUpgrade poppler-utilsUpgrade poppler-cpp-develUpgrade poppler-glib-develUpgrade poppler-demosUpgrade poppler-qtUpgrade poppler-qt-develUpgrade popplerUpgrade poppler-glibUpgrade poppler-cppUpgrade poppler-debuginfo | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade poppler-demosUpgrade poppler-utils-debuginfoUpgrade okular-develUpgrade poppler-qtUpgrade poppler-qt5-debuginfoUpgrade poppler-debugsourceUpgrade poppler-qt-develUpgrade okular-partUpgrade poppler-utilsUpgrade evince-nautilusUpgrade poppler-develUpgrade evince-develUpgrade poppler-debuginfoUpgrade poppler-cpp-debuginfoUpgrade okular-debuginfoUpgrade evince-libsUpgrade poppler-cpp-develUpgrade evince-debuginfoUpgrade okular-libsUpgrade poppler-glib-develUpgrade popplerUpgrade poppler-glib-debuginfoUpgrade poppler-cppUpgrade poppler-glibUpgrade evinceUpgrade okularUpgrade evince-browser-pluginUpgrade evince-dvi | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-cppUpgrade popplerUpgrade poppler-help | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade poppler-glib-develUpgrade okular-develUpgrade okular-partUpgrade poppler-qt5-develUpgrade poppler-qt5Upgrade poppler-qt-develUpgrade evince-develUpgrade poppler-develUpgrade poppler-qtUpgrade poppler-demosUpgrade evince-nautilusUpgrade poppler-cpp-develUpgrade poppler-utilsUpgrade poppler-glibUpgrade evince-dviUpgrade okular-libsUpgrade evince-libsUpgrade okularUpgrade popplerUpgrade evinceUpgrade poppler-cppUpgrade evince-browser-plugin | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade evince-nautilusUpgrade evince-dviUpgrade evince-libsUpgrade poppler-demosUpgrade poppler-cpp-debuginfoUpgrade okular-debuginfoUpgrade poppler-qt5-debuginfoUpgrade poppler-debugsourceUpgrade okular-libsUpgrade okularUpgrade evince-browser-pluginUpgrade okular-develUpgrade poppler-debuginfoUpgrade poppler-glibUpgrade evince-debuginfoUpgrade evinceNo solution existsUpgrade poppler-cpp-develUpgrade poppler-qt-develUpgrade poppler-develUpgrade poppler-qt5Upgrade evince-develUpgrade poppler-glib-debuginfoUpgrade poppler-utils-debuginfoUpgrade popplerUpgrade poppler-utilsUpgrade okular-partUpgrade poppler-cppUpgrade poppler-qt5-develUpgrade poppler-qtUpgrade poppler-glib-devel | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-glib8Upgrade libpoppler73-32bitUpgrade libpoppler-develUpgrade poppler-toolsUpgrade libpoppler-glib-develUpgrade libpoppler73Upgrade libpoppler-cpp0 | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler79Upgrade libpoppler73Upgrade libpoppler44Upgrade poppler-utils | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub