freedesktop poppler 0.71.0 vulnerabilities and exploits

(subscribe to this query)

An issue exists in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.

Freedesktop Poppler 0.71.0 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.10 Canonical Ubuntu Linux 16.04

An issue exists in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.

Freedesktop Poppler 0.71.0 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.10 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 16.04

An issue exists in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

Freedesktop Poppler 0.71.0 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Server 7.0

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

Freedesktop Poppler 0.74.0 Fedoraproject Fedora 28 Fedoraproject Fedora 29 Fedoraproject Fedora 30 Debian Debian Linux 8.0

Poppler prior to 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.

Freedesktop Poppler Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote malicious users to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.c...

Freedesktop Poppler 0.72.0 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10 Canonical Ubuntu Linux 14.04 Debian Debian Linux 8.0

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.

Freedesktop Poppler 0.68.0 Debian Debian Linux 8.0 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 18.10 Canonical Ubuntu Linux 18.04

1 Github repository

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an malicious user to cause Denial of Service (Segmentation fault) or possibl...

Freedesktop Poppler 0.74.0 Debian Debian Linux 8.0 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote malicious users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as ...

Freedesktop Poppler 0.73.0 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Fedoraproject Fedora 28 Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Server 7.0 Redhat Enterprise Linux 8.0 Redhat Enterprise Linux Eus 8.1 Redhat Enterprise Linux Eus 8.2 Redhat Enterprise Linux Server Tus 8.2 Redhat Enterprise Linux Server Aus 8.2 Redhat Enterprise Linux Server Tus 8.4 Redhat Enterprise Linux Eus 8.4 Redhat Enterprise Linux Server Aus 8.4

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook