XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-qtUpgrade poppler-cpp-develUpgrade poppler-demosUpgrade poppler-develUpgrade poppler-glib-develUpgrade poppler-utilsUpgrade poppler-debuginfoUpgrade poppler-qt-develUpgrade popplerUpgrade poppler-cppUpgrade poppler-glib | Apr 27, 2020 | Dec 26, 2018 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Dec 25, 2018 |
| Centos_linux | — | Upgrade poppler-develUpgrade okular-develUpgrade poppler-debuginfoUpgrade poppler-cpp-develUpgrade poppler-debugsourceUpgrade poppler-cpp-debuginfoUpgrade okular-debuginfoUpgrade poppler-demosUpgrade poppler-qt-develUpgrade poppler-utilsUpgrade okular-partUpgrade poppler-qtUpgrade evince-libsUpgrade evince-develUpgrade evince-nautilusUpgrade evince-debuginfoUpgrade poppler-utils-debuginfoUpgrade poppler-qt5-debuginfoUpgrade evince-dviUpgrade poppler-cppUpgrade poppler-glib-debuginfoUpgrade poppler-glibUpgrade evinceUpgrade okular-libsUpgrade popplerUpgrade evince-browser-pluginUpgrade poppler-glib-develUpgrade okular | Aug 28, 2019 | Dec 26, 2018 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Dec 25, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-cppUpgrade poppler-helpUpgrade poppler | Feb 8, 2021 | Dec 26, 2018 |
| Oracle_linux | — | Upgrade evince-libsUpgrade poppler-glibUpgrade okular-libsUpgrade poppler-cppUpgrade evinceUpgrade okularUpgrade popplerUpgrade evince-dviUpgrade evince-browser-pluginUpgrade poppler-utilsUpgrade poppler-qt5-develUpgrade okular-develUpgrade poppler-qt-develUpgrade poppler-demosUpgrade evince-nautilusUpgrade poppler-cpp-develUpgrade evince-develUpgrade okular-partUpgrade poppler-glib-develUpgrade poppler-develUpgrade poppler-qt5Upgrade poppler-qt | Jul 21, 2020 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade evince-dviUpgrade poppler-debuginfoUpgrade okular-develUpgrade poppler-glibUpgrade poppler-cpp-debuginfoUpgrade evince-libsUpgrade okular-libsUpgrade poppler-qt5-debuginfoUpgrade evince-browser-pluginUpgrade okularUpgrade poppler-debugsourceUpgrade evince-nautilusUpgrade okular-debuginfoUpgrade poppler-demosUpgrade popplerUpgrade poppler-qtUpgrade poppler-qt-develUpgrade poppler-utilsUpgrade poppler-glib-debuginfoUpgrade poppler-develUpgrade evince-develNo solution existsUpgrade evinceUpgrade poppler-utils-debuginfoUpgrade poppler-qt5-develUpgrade evince-debuginfoUpgrade poppler-cppUpgrade poppler-glib-develUpgrade poppler-qt5Upgrade okular-partUpgrade poppler-cpp-devel | Aug 7, 2019 | Dec 26, 2018 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade libpoppler-glib8Upgrade libpoppler-develUpgrade libpoppler-glib-develUpgrade poppler-toolsUpgrade libpoppler73Upgrade libpoppler-cpp0 | Dec 2, 2021 | Dec 25, 2018 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler73Upgrade libpoppler79Upgrade poppler-utilsUpgrade libpoppler44 | Jan 31, 2019 | Dec 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub