XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-cpp-develUpgrade poppler-qtUpgrade poppler-develUpgrade poppler-demosUpgrade poppler-utilsUpgrade poppler-glib-develUpgrade popplerUpgrade poppler-glibUpgrade poppler-debuginfoUpgrade poppler-qt-develUpgrade poppler-cpp | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade okular-debuginfoUpgrade poppler-debuginfoUpgrade poppler-cpp-develUpgrade evince-develUpgrade evince-libsUpgrade poppler-utils-debuginfoUpgrade poppler-demosUpgrade evince-debuginfoUpgrade poppler-qt-develUpgrade poppler-qtUpgrade poppler-develUpgrade okular-partUpgrade okular-develUpgrade poppler-qt5-debuginfoUpgrade poppler-utilsUpgrade poppler-debugsourceUpgrade poppler-cpp-debuginfoUpgrade evince-nautilusUpgrade evince-browser-pluginUpgrade evince-dviUpgrade poppler-glib-develUpgrade popplerUpgrade evinceUpgrade okularUpgrade poppler-glibUpgrade poppler-cppUpgrade okular-libsUpgrade poppler-glib-debuginfo | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-helpUpgrade popplerUpgrade poppler-cpp | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade evince-libsUpgrade evince-browser-pluginUpgrade poppler-glibUpgrade okular-libsUpgrade popplerUpgrade poppler-cppUpgrade okularUpgrade evinceUpgrade evince-dviUpgrade poppler-develUpgrade poppler-cpp-develUpgrade evince-nautilusUpgrade poppler-qt-develUpgrade poppler-utilsUpgrade okular-develUpgrade poppler-qtUpgrade poppler-qt5Upgrade evince-develUpgrade okular-partUpgrade poppler-demosUpgrade poppler-qt5-develUpgrade poppler-glib-devel | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade poppler-qt5Upgrade poppler-develUpgrade poppler-utilsUpgrade evince-develNo solution existsUpgrade evinceUpgrade poppler-qt5-develUpgrade poppler-cpp-develUpgrade poppler-qt-develUpgrade poppler-cppUpgrade popplerUpgrade evince-debuginfoUpgrade poppler-glib-develUpgrade poppler-qtUpgrade poppler-utils-debuginfoUpgrade poppler-glib-debuginfoUpgrade okular-partUpgrade okular-develUpgrade evince-dviUpgrade evince-browser-pluginUpgrade poppler-debuginfoUpgrade poppler-demosUpgrade okularUpgrade okular-debuginfoUpgrade poppler-debugsourceUpgrade okular-libsUpgrade evince-nautilusUpgrade evince-libsUpgrade poppler-glibUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5-debuginfo | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade libpoppler73Upgrade poppler-toolsUpgrade libpoppler-cpp0Upgrade libpoppler-glib-develUpgrade libpoppler73-32bitUpgrade libpoppler-glib8Upgrade libpoppler-develUpgrade typelib-1_0-Poppler-0_18 | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade poppler-utilsUpgrade libpoppler44Upgrade libpoppler73Upgrade libpoppler79 | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub