A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade popplerUpgrade poppler-develUpgrade poppler-qtUpgrade poppler-qt-develUpgrade poppler-cppUpgrade poppler-glib-develUpgrade poppler-utilsUpgrade poppler-cpp-develUpgrade poppler-glibUpgrade poppler-demosUpgrade poppler-debuginfo | Apr 27, 2020 | Feb 26, 2019 |
| Amazon_linux | — | Upgrade poppler | Aug 28, 2019 | Feb 26, 2019 |
| Centos_linux | — | Upgrade poppler-qt-develUpgrade evince-debuginfoUpgrade poppler-cppUpgrade poppler-glib-debuginfoUpgrade okular-develUpgrade evince-browser-pluginUpgrade poppler-demosUpgrade poppler-qt5-debuginfoUpgrade evince-nautilusUpgrade poppler-utils-debuginfoUpgrade poppler-cpp-debuginfoUpgrade poppler-utilsUpgrade poppler-develUpgrade okular-libsUpgrade evince-libsUpgrade okularUpgrade evince-dviUpgrade popplerUpgrade poppler-glibUpgrade evinceUpgrade poppler-debugsourceUpgrade okular-partUpgrade okular-debuginfoUpgrade poppler-cpp-develUpgrade evince-develUpgrade poppler-qtUpgrade poppler-glib-develUpgrade poppler-debuginfo | Aug 28, 2019 | Feb 26, 2019 |
| Debian | — | Upgrade poppler | Mar 12, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade popplerUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler-qt | Apr 2, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade poppler-utilsUpgrade poppler-qtUpgrade poppler-glibUpgrade poppler | May 7, 2019 | Feb 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade popplerUpgrade poppler-glibUpgrade poppler-qtUpgrade poppler-utils | Apr 3, 2019 | Feb 26, 2019 |
| Oracle Solaris | — | Upgrade desktop/pdf-viewer/poppler to version 0.75.0-11.4.10.0.1.2.0 on Solaris 11.4 | Jun 26, 2019 | Feb 26, 2019 |
| Oracle_linux | — | Upgrade poppler-demosUpgrade poppler-utilsUpgrade evince-nautilusUpgrade okular-develUpgrade evince-libsUpgrade poppler-qt5-develUpgrade okular-libsUpgrade poppler-develUpgrade poppler-cppUpgrade poppler-qt5Upgrade poppler-qt-develUpgrade okular-partUpgrade evince-browser-pluginUpgrade poppler-glib-develUpgrade evince-dviUpgrade poppler-qtUpgrade evince-develUpgrade okularUpgrade popplerUpgrade evinceUpgrade poppler-glibUpgrade poppler-cpp-devel | Jul 21, 2020 | Feb 25, 2019 |
| Redhat_linux | — | Upgrade poppler-debuginfoUpgrade okular-debuginfoUpgrade poppler-debugsourceUpgrade popplerUpgrade evince-dviUpgrade poppler-glibUpgrade okular-partUpgrade okular-develUpgrade poppler-utils-debuginfoUpgrade okularUpgrade evince-debuginfoUpgrade okular-libsUpgrade poppler-qt5-debuginfoUpgrade poppler-qt5Upgrade evince-browser-pluginUpgrade evince-develUpgrade poppler-glib-develUpgrade poppler-glib-debuginfoUpgrade poppler-cpp-debuginfoUpgrade poppler-cpp-develUpgrade poppler-qt5-develUpgrade poppler-qtUpgrade evince-libsUpgrade evince-nautilusUpgrade poppler-develUpgrade evinceUpgrade poppler-cppUpgrade poppler-qt-develUpgrade poppler-utilsUpgrade poppler-demos | Aug 7, 2019 | Feb 26, 2019 |
| Suse | — | Upgrade libpoppler-glib8Upgrade poppler-toolsUpgrade libpoppler-glib-develUpgrade libpoppler73Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-cpp0Upgrade libpoppler73-32bitUpgrade libpoppler-devel | Dec 2, 2021 | Feb 26, 2019 |
| Ubuntu | — | Upgrade libpoppler44Upgrade libpoppler58Upgrade poppler-utilsUpgrade libpoppler79Upgrade libpoppler85Upgrade libpoppler73 | Mar 19, 2019 | Feb 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub