A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade popplerUpgrade poppler-utilsUpgrade poppler-develUpgrade poppler-cpp-develUpgrade poppler-qt-develUpgrade poppler-cppUpgrade poppler-glib-develUpgrade poppler-qtUpgrade poppler-demosUpgrade poppler-debuginfoUpgrade poppler-glib | Apr 27, 2020 | Feb 26, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 26, 2019 |
| Centos_linux | — | Upgrade evince-dviUpgrade evince-develUpgrade poppler-glibUpgrade poppler-glib-develUpgrade poppler-qtUpgrade poppler-cpp-develUpgrade okular-partUpgrade evinceUpgrade poppler-debugsourceUpgrade okularUpgrade poppler-debuginfoUpgrade popplerUpgrade okular-debuginfoUpgrade evince-libsUpgrade okular-libsUpgrade poppler-cppUpgrade poppler-utilsUpgrade poppler-demosUpgrade poppler-develUpgrade poppler-cpp-debuginfoUpgrade poppler-glib-debuginfoUpgrade poppler-qt-develUpgrade okular-develUpgrade evince-nautilusUpgrade poppler-utils-debuginfoUpgrade poppler-qt5-debuginfoUpgrade evince-debuginfoUpgrade evince-browser-plugin | Aug 28, 2019 | Feb 26, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade popplerUpgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utils | Apr 2, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-glibUpgrade poppler-utilsUpgrade popplerUpgrade poppler-qt | May 7, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade popplerUpgrade poppler-glib | Apr 3, 2019 | Feb 26, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 26, 2019 |
| Oracle_linux | — | Upgrade poppler-qt5-develUpgrade okular-develUpgrade poppler-cppUpgrade poppler-qt5Upgrade poppler-utilsUpgrade poppler-develUpgrade poppler-demosUpgrade evince-libsUpgrade evince-nautilusUpgrade okular-libsUpgrade okular-partUpgrade poppler-qt-develUpgrade okularUpgrade evinceUpgrade evince-develUpgrade poppler-glibUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade evince-browser-pluginUpgrade evince-dviUpgrade poppler-glib-develUpgrade poppler | Jul 21, 2020 | Feb 25, 2019 |
| Redhat_linux | — | Upgrade evince-libsUpgrade evince-develUpgrade poppler-cpp-debuginfoUpgrade evince-nautilusUpgrade poppler-qt5-develUpgrade poppler-cppUpgrade poppler-qt-develUpgrade evinceUpgrade poppler-develUpgrade poppler-demosUpgrade evince-browser-pluginUpgrade poppler-cpp-develUpgrade poppler-glib-debuginfoUpgrade poppler-glib-develUpgrade poppler-qtUpgrade poppler-qt5-debuginfoUpgrade poppler-qt5Upgrade poppler-utilsUpgrade evince-debuginfoUpgrade popplerUpgrade okular-libsUpgrade okular-debuginfoUpgrade poppler-debugsourceUpgrade okularUpgrade evince-dviUpgrade poppler-glibUpgrade okular-partUpgrade okular-develUpgrade poppler-utils-debuginfoUpgrade poppler-debuginfo | Aug 7, 2019 | Feb 26, 2019 |
| Suse | — | Upgrade libpoppler-glib-develUpgrade poppler-toolsUpgrade libpoppler-glib8Upgrade libpoppler73Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade libpoppler-cpp0Upgrade libpoppler-devel | Dec 2, 2021 | Feb 26, 2019 |
| Ubuntu | — | Upgrade libpoppler85Upgrade libpoppler73Upgrade poppler-utilsUpgrade libpoppler58Upgrade libpoppler79Upgrade libpoppler44 | Mar 19, 2019 | Feb 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub