In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-demosUpgrade poppler-glib-develUpgrade poppler-qt-develUpgrade poppler-develUpgrade poppler-debuginfoUpgrade poppler-qtUpgrade popplerUpgrade poppler-cpp-develUpgrade poppler-cppUpgrade poppler-glibUpgrade poppler-utils | Apr 27, 2020 | Feb 3, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 2, 2019 |
| Centos_linux | — | Upgrade poppler-cppUpgrade poppler-glib-debuginfoUpgrade okular-partUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade evince-libsUpgrade evince-debuginfoUpgrade evince-develUpgrade okular-libsUpgrade poppler-utilsUpgrade evinceUpgrade poppler-develUpgrade poppler-utils-debuginfoUpgrade poppler-glib-develUpgrade poppler-qt-develUpgrade poppler-demosUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5-debuginfoUpgrade okularUpgrade poppler-debugsourceUpgrade poppler-debuginfoUpgrade okular-debuginfoUpgrade okular-develUpgrade evince-nautilusUpgrade poppler-glibUpgrade popplerUpgrade evince-browser-pluginUpgrade evince-dvi | Aug 28, 2019 | Feb 3, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade popplerUpgrade poppler-glibUpgrade poppler-qtUpgrade poppler-utils | Feb 22, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade popplerUpgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utils | Mar 27, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-glibUpgrade popplerUpgrade poppler-qtUpgrade poppler-utils | Mar 11, 2019 | Feb 2, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utilsUpgrade poppler | Aug 31, 2020 | Feb 3, 2019 |
| Huawei Euleros 2_0_sp9 | — | Upgrade poppler-cppUpgrade popplerUpgrade poppler-help | Feb 8, 2021 | Feb 3, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 3, 2019 |
| Oracle_linux | — | Upgrade evince-nautilusUpgrade okular-partUpgrade evince-browser-pluginUpgrade poppler-qtUpgrade poppler-develUpgrade poppler-glib-develUpgrade okular-develUpgrade poppler-qt5-develUpgrade poppler-utilsUpgrade poppler-cppUpgrade poppler-cpp-develUpgrade poppler-demosUpgrade evince-develUpgrade evince-libsUpgrade poppler-qt-develUpgrade poppler-glibUpgrade evinceUpgrade evince-dviUpgrade okular-libsUpgrade okularUpgrade poppler-qt5Upgrade poppler | Jul 21, 2020 | Feb 1, 2019 |
| Redhat_linux | — | Upgrade okular-libsUpgrade okular-develUpgrade evince-nautilusUpgrade poppler-cpp-debuginfoUpgrade okular-debuginfoUpgrade poppler-qt5-develUpgrade poppler-demosUpgrade okular-partUpgrade poppler-qt5-debuginfoUpgrade okularUpgrade poppler-develUpgrade evince-libsUpgrade poppler-debuginfoUpgrade evince-browser-pluginUpgrade poppler-qt5Upgrade poppler-qt-develUpgrade poppler-cppUpgrade popplerUpgrade poppler-glibUpgrade poppler-debugsourceUpgrade poppler-glib-debuginfoUpgrade evince-develUpgrade evince-dviUpgrade poppler-utilsUpgrade evince-debuginfoUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade evinceUpgrade poppler-utils-debuginfoUpgrade poppler-glib-devel | Aug 7, 2019 | Feb 3, 2019 |
| Suse | — | Upgrade libpoppler-glib8Upgrade libpoppler-develUpgrade libpoppler73Upgrade poppler-toolsUpgrade libpoppler-glib-develUpgrade libpoppler73-32bitUpgrade libpoppler-cpp0Upgrade typelib-1_0-Poppler-0_18 | Dec 2, 2021 | Feb 2, 2019 |
| Ubuntu | — | Upgrade libpoppler58Upgrade libpoppler73Upgrade libpoppler79Upgrade poppler-utilsUpgrade libpoppler44 | Feb 16, 2019 | Feb 2, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub