Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2-2019-1332

Related Vulnerabilities: CVE-2018-16646   CVE-2018-18897   CVE-2018-19058   CVE-2018-19059   CVE-2018-19060   CVE-2018-19149   CVE-2018-20481   CVE-2018-20650   CVE-2018-20662   CVE-2019-7310   CVE-2019-9200   CVE-2019-9631  

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.(CVE-2018-16646) An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.(CVE-2018-18897) An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.(CVE-2018-19058) An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.(CVE-2018-19059) An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.(CVE-2018-19060) Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.(CVE-2018-19149) XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.(CVE-2018-20481) A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.(CVE-2018-20650) In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.(CVE-2018-20662) In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.(CVE-2019-7310) A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.(CVE-2019-9200) Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.(CVE-2019-9631)

Source

ALAS2-2019-1332

Amazon Linux 2 Security Advisory: ALAS-2019-1332
Advisory Release Date: 2019-10-21 18:01 Pacific
Advisory Updated Date: 2019-10-23 23:58 Pacific
Severity: Medium
Issue Overview:

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.(CVE-2018-16646)

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.(CVE-2018-18897)

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.(CVE-2018-19058)

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.(CVE-2018-19059)

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.(CVE-2018-19060)

Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.(CVE-2018-19149)

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.(CVE-2018-20481)

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.(CVE-2018-20650)

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.(CVE-2018-20662)

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.(CVE-2019-7310)

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.(CVE-2019-9200)

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.(CVE-2019-9631)


Affected Packages:

poppler


Issue Correction:
Run yum update poppler to update your system.

New Packages:
aarch64:
    poppler-0.26.5-38.amzn2.aarch64
    poppler-devel-0.26.5-38.amzn2.aarch64
    poppler-glib-0.26.5-38.amzn2.aarch64
    poppler-glib-devel-0.26.5-38.amzn2.aarch64
    poppler-qt-0.26.5-38.amzn2.aarch64
    poppler-qt-devel-0.26.5-38.amzn2.aarch64
    poppler-cpp-0.26.5-38.amzn2.aarch64
    poppler-cpp-devel-0.26.5-38.amzn2.aarch64
    poppler-utils-0.26.5-38.amzn2.aarch64
    poppler-demos-0.26.5-38.amzn2.aarch64
    poppler-debuginfo-0.26.5-38.amzn2.aarch64

i686:
    poppler-0.26.5-38.amzn2.i686
    poppler-devel-0.26.5-38.amzn2.i686
    poppler-glib-0.26.5-38.amzn2.i686
    poppler-glib-devel-0.26.5-38.amzn2.i686
    poppler-qt-0.26.5-38.amzn2.i686
    poppler-qt-devel-0.26.5-38.amzn2.i686
    poppler-cpp-0.26.5-38.amzn2.i686
    poppler-cpp-devel-0.26.5-38.amzn2.i686
    poppler-utils-0.26.5-38.amzn2.i686
    poppler-demos-0.26.5-38.amzn2.i686
    poppler-debuginfo-0.26.5-38.amzn2.i686

src:
    poppler-0.26.5-38.amzn2.src

x86_64:
    poppler-0.26.5-38.amzn2.x86_64
    poppler-devel-0.26.5-38.amzn2.x86_64
    poppler-glib-0.26.5-38.amzn2.x86_64
    poppler-glib-devel-0.26.5-38.amzn2.x86_64
    poppler-qt-0.26.5-38.amzn2.x86_64
    poppler-qt-devel-0.26.5-38.amzn2.x86_64
    poppler-cpp-0.26.5-38.amzn2.x86_64
    poppler-cpp-devel-0.26.5-38.amzn2.x86_64
    poppler-utils-0.26.5-38.amzn2.x86_64
    poppler-demos-0.26.5-38.amzn2.x86_64
    poppler-debuginfo-0.26.5-38.amzn2.x86_64

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started