A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade poppler-debuginfoUpgrade poppler-glibUpgrade poppler-demosUpgrade poppler-glib-develUpgrade poppler-cpp-develUpgrade poppler-develUpgrade popplerUpgrade poppler-cppUpgrade poppler-qt-develUpgrade poppler-utilsUpgrade poppler-qt | Apr 27, 2020 | Feb 26, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 26, 2019 |
| Centos_linux | — | Upgrade evinceUpgrade poppler-cpp-develUpgrade evince-develUpgrade popplerUpgrade okular-debuginfoUpgrade poppler-glib-develUpgrade poppler-debuginfoUpgrade evince-dviUpgrade okularUpgrade poppler-debugsourceUpgrade okular-partUpgrade poppler-glibUpgrade poppler-qtUpgrade poppler-qt-develUpgrade evince-browser-pluginUpgrade evince-nautilusUpgrade poppler-cppUpgrade poppler-glib-debuginfoUpgrade poppler-cpp-debuginfoUpgrade okular-libsUpgrade evince-libsUpgrade poppler-utilsUpgrade poppler-demosUpgrade poppler-develUpgrade evince-debuginfoUpgrade okular-develUpgrade poppler-qt5-debuginfoUpgrade poppler-utils-debuginfo | Aug 28, 2019 | Feb 26, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade popplerUpgrade poppler-qtUpgrade poppler-glibUpgrade poppler-utils | Apr 2, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-utilsUpgrade poppler-glibUpgrade popplerUpgrade poppler-qt | May 7, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade popplerUpgrade poppler-glib | Apr 3, 2019 | Feb 26, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 26, 2019 |
| Oracle_linux | — | Upgrade evince-browser-pluginUpgrade poppler-cpp-develUpgrade evince-dviUpgrade poppler-glibUpgrade poppler-glib-develUpgrade evince-develUpgrade popplerUpgrade poppler-qtUpgrade evinceUpgrade okularUpgrade okular-libsUpgrade poppler-cppUpgrade okular-partUpgrade poppler-develUpgrade poppler-qt5Upgrade evince-libsUpgrade okular-develUpgrade poppler-qt5-develUpgrade poppler-utilsUpgrade poppler-demosUpgrade evince-nautilusUpgrade poppler-qt-devel | Jul 21, 2020 | Feb 25, 2019 |
| Redhat_linux | — | Upgrade poppler-qtUpgrade poppler-cpp-develUpgrade poppler-glib-develUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5Upgrade poppler-qt5-debuginfoUpgrade evince-develUpgrade evince-nautilusUpgrade poppler-qt-develUpgrade poppler-glib-debuginfoUpgrade poppler-develUpgrade evinceUpgrade evince-libsUpgrade poppler-utilsUpgrade evince-browser-pluginUpgrade poppler-qt5-develUpgrade poppler-demosUpgrade poppler-cppUpgrade okular-develUpgrade okular-libsUpgrade popplerUpgrade evince-dviUpgrade poppler-debugsourceUpgrade evince-debuginfoUpgrade okularUpgrade okular-partUpgrade poppler-utils-debuginfoUpgrade okular-debuginfoUpgrade poppler-glibUpgrade poppler-debuginfo | Aug 7, 2019 | Feb 26, 2019 |
| Suse | — | Upgrade libpoppler-glib-develUpgrade poppler-toolsUpgrade libpoppler-glib8Upgrade libpoppler-cpp0Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-develUpgrade libpoppler73Upgrade libpoppler73-32bit | Dec 2, 2021 | Feb 26, 2019 |
| Ubuntu | — | Upgrade poppler-utilsUpgrade libpoppler58Upgrade libpoppler79Upgrade libpoppler44Upgrade libpoppler85Upgrade libpoppler73 | Mar 19, 2019 | Feb 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub