A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade popplerUpgrade poppler-utilsUpgrade poppler-cppUpgrade poppler-qtUpgrade poppler-qt-develUpgrade poppler-glib-develUpgrade poppler-develUpgrade poppler-cpp-develUpgrade poppler-glibUpgrade poppler-debuginfoUpgrade poppler-demos | Apr 27, 2020 | Feb 26, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 26, 2019 |
| Centos_linux | — | Upgrade okular-develUpgrade poppler-qt-develUpgrade poppler-demosUpgrade poppler-glib-debuginfoUpgrade evince-debuginfoUpgrade poppler-utils-debuginfoUpgrade evince-nautilusUpgrade poppler-utilsUpgrade evince-browser-pluginUpgrade poppler-cppUpgrade poppler-cpp-debuginfoUpgrade evince-libsUpgrade okular-libsUpgrade poppler-develUpgrade poppler-qt5-debuginfoUpgrade poppler-glibUpgrade poppler-qtUpgrade okularUpgrade okular-partUpgrade poppler-debuginfoUpgrade poppler-cpp-develUpgrade evinceUpgrade evince-develUpgrade evince-dviUpgrade popplerUpgrade okular-debuginfoUpgrade poppler-debugsourceUpgrade poppler-glib-devel | Aug 28, 2019 | Feb 26, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade poppler-qtUpgrade popplerUpgrade poppler-glibUpgrade poppler-utils | Apr 2, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler | May 7, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade poppler-qtUpgrade poppler-utilsUpgrade popplerUpgrade poppler-glib | Apr 3, 2019 | Feb 26, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 26, 2019 |
| Oracle_linux | — | Upgrade poppler-glib-develUpgrade poppler-cpp-develUpgrade evinceUpgrade poppler-glibUpgrade poppler-qtUpgrade okularUpgrade popplerUpgrade evince-dviUpgrade evince-develUpgrade evince-browser-pluginUpgrade evince-libsUpgrade okular-libsUpgrade evince-nautilusUpgrade poppler-demosUpgrade poppler-qt5-develUpgrade okular-partUpgrade poppler-qt-develUpgrade poppler-cppUpgrade okular-develUpgrade poppler-qt5Upgrade poppler-develUpgrade poppler-utils | Jul 21, 2020 | Feb 25, 2019 |
| Redhat_linux | — | Upgrade poppler-cpp-debuginfoUpgrade poppler-cppUpgrade poppler-utilsUpgrade poppler-glib-debuginfoUpgrade poppler-develUpgrade evinceUpgrade poppler-qt-develUpgrade evince-develUpgrade poppler-cpp-develUpgrade poppler-qtUpgrade evince-nautilusUpgrade poppler-qt5-debuginfoUpgrade poppler-qt5-develUpgrade evince-browser-pluginUpgrade poppler-demosUpgrade poppler-glib-develUpgrade poppler-qt5Upgrade evince-libsUpgrade okular-libsUpgrade okularUpgrade poppler-utils-debuginfoUpgrade okular-debuginfoUpgrade okular-partUpgrade evince-dviUpgrade poppler-debuginfoUpgrade popplerUpgrade okular-develUpgrade poppler-debugsourceUpgrade evince-debuginfoUpgrade poppler-glib | Aug 7, 2019 | Feb 26, 2019 |
| Suse | — | Upgrade libpoppler73-32bitUpgrade libpoppler-develUpgrade libpoppler-cpp0Upgrade libpoppler73Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-glib-develUpgrade poppler-toolsUpgrade libpoppler-glib8 | Dec 2, 2021 | Feb 26, 2019 |
| Ubuntu | — | Upgrade poppler-utilsUpgrade libpoppler79Upgrade libpoppler44Upgrade libpoppler58Upgrade libpoppler73Upgrade libpoppler85 | Mar 19, 2019 | Feb 26, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub