A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade poppler-debuginfoUpgrade poppler-qt5-debuginfoUpgrade popplerUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-utils-debuginfoUpgrade poppler-debugsourceUpgrade poppler-cpp-debuginfoUpgrade poppler-glib-debuginfo | Sep 12, 2019 | Dec 28, 2018 |
| Debian | — | Upgrade poppler | Jul 30, 2024 | Dec 28, 2018 |
| Oracle_linux | — | Upgrade poppler-glib-develUpgrade poppler-cppUpgrade poppler-cpp-develUpgrade popplerUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler-qt5Upgrade poppler-develUpgrade poppler-qt5-devel | Jul 21, 2020 | Dec 26, 2018 |
| Redhat_linux | — | Upgrade poppler-debugsourceUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5-debuginfoUpgrade poppler-debuginfoUpgrade poppler-glibUpgrade poppler-utils-debuginfoUpgrade poppler-cppUpgrade poppler-cpp-develUpgrade poppler-develUpgrade poppler-qt5Upgrade poppler-glib-develUpgrade popplerUpgrade poppler-glib-debuginfoUpgrade poppler-qt5-develUpgrade poppler-utils | Sep 12, 2019 | Dec 28, 2018 |
| Suse | — | Upgrade poppler-toolsUpgrade libpoppler-cpp0Upgrade libpoppler73Upgrade libpoppler73-32bitUpgrade libpoppler-glib8Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-develUpgrade libpoppler-glib-devel | Dec 2, 2021 | Dec 28, 2018 |
| Ubuntu | — | Upgrade libpoppler79Upgrade libpoppler58Upgrade poppler-utilsUpgrade libpoppler44Upgrade libpoppler73 | Feb 16, 2019 | Dec 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub