In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-cppUpgrade popplerUpgrade poppler-cpp-develUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-qt-develUpgrade poppler-qtUpgrade poppler-debuginfoUpgrade poppler-develUpgrade poppler-demosUpgrade poppler-glib-devel | Apr 27, 2020 | Feb 3, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 2, 2019 |
| Centos_linux | — | Upgrade evince-develUpgrade evince-libsUpgrade poppler-glib-develUpgrade poppler-utils-debuginfoUpgrade poppler-develUpgrade okular-partUpgrade poppler-glib-debuginfoUpgrade poppler-cpp-develUpgrade poppler-demosUpgrade evinceUpgrade evince-debuginfoUpgrade poppler-qt-develUpgrade poppler-qtUpgrade poppler-cpp-debuginfoUpgrade poppler-utilsUpgrade poppler-cppUpgrade okular-libsUpgrade poppler-debuginfoUpgrade okularUpgrade poppler-qt5-debuginfoUpgrade popplerUpgrade evince-browser-pluginUpgrade poppler-debugsourceUpgrade evince-nautilusUpgrade evince-dviUpgrade okular-debuginfoUpgrade poppler-glibUpgrade okular-devel | Aug 28, 2019 | Feb 3, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler | Feb 22, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade popplerUpgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utils | Mar 27, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-glibUpgrade popplerUpgrade poppler-utilsUpgrade poppler-qt | Mar 11, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade popplerUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-qt | Aug 31, 2020 | Feb 3, 2019 |
| Huawei Euleros 2_0_sp9 | — | Upgrade popplerUpgrade poppler-cppUpgrade poppler-help | Feb 8, 2021 | Feb 3, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 3, 2019 |
| Oracle_linux | — | Upgrade evince-nautilusUpgrade evince-develUpgrade poppler-develUpgrade evince-browser-pluginUpgrade poppler-qtUpgrade poppler-glib-develUpgrade poppler-qt5-develUpgrade poppler-utilsUpgrade okular-develUpgrade poppler-cpp-develUpgrade poppler-demosUpgrade poppler-cppUpgrade okular-partUpgrade poppler-glibUpgrade poppler-qt5Upgrade poppler-qt-develUpgrade evince-libsUpgrade evinceUpgrade evince-dviUpgrade okular-libsUpgrade popplerUpgrade okular | Jul 21, 2020 | Feb 1, 2019 |
| Redhat_linux | — | Upgrade poppler-qt-develUpgrade evinceUpgrade poppler-utils-debuginfoUpgrade poppler-utilsUpgrade evince-develUpgrade evince-dviUpgrade evince-debuginfoUpgrade poppler-glib-debuginfoUpgrade poppler-debugsourceUpgrade poppler-cppUpgrade poppler-glibUpgrade popplerUpgrade poppler-qtUpgrade poppler-cpp-develUpgrade poppler-glib-develUpgrade poppler-debuginfoUpgrade okular-develUpgrade okular-partUpgrade poppler-qt5Upgrade poppler-develUpgrade okular-libsUpgrade poppler-demosUpgrade okularUpgrade poppler-qt5-debuginfoUpgrade poppler-qt5-develUpgrade evince-browser-pluginUpgrade poppler-cpp-debuginfoUpgrade okular-debuginfoUpgrade evince-nautilusUpgrade evince-libs | Aug 7, 2019 | Feb 3, 2019 |
| Suse | — | Upgrade libpoppler-cpp0Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade poppler-toolsUpgrade libpoppler-glib-develUpgrade libpoppler-glib8Upgrade libpoppler-develUpgrade libpoppler73 | Dec 2, 2021 | Feb 2, 2019 |
| Ubuntu | — | Upgrade libpoppler73Upgrade libpoppler58Upgrade libpoppler79Upgrade poppler-utilsUpgrade libpoppler44 | Feb 16, 2019 | Feb 2, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub