Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2-2023-2243

Related Vulnerabilities: CVE-2020-18839   CVE-2022-37050  

Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service. (CVE-2020-18839) In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. (CVE-2022-37050)

Source

ALAS2-2023-2243

Amazon Linux 2 Security Advisory: ALAS-2023-2243
Advisory Release Date: 2023-08-31 22:30 Pacific
Advisory Updated Date: 2023-09-07 18:48 Pacific
Severity: Medium
Issue Overview:

Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service. (CVE-2020-18839)

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. (CVE-2022-37050)


Affected Packages:

poppler


Issue Correction:
Run yum update poppler to update your system.

New Packages:
aarch64:
    poppler-0.26.5-43.amzn2.1.4.aarch64
    poppler-devel-0.26.5-43.amzn2.1.4.aarch64
    poppler-glib-0.26.5-43.amzn2.1.4.aarch64
    poppler-glib-devel-0.26.5-43.amzn2.1.4.aarch64
    poppler-qt-0.26.5-43.amzn2.1.4.aarch64
    poppler-qt-devel-0.26.5-43.amzn2.1.4.aarch64
    poppler-cpp-0.26.5-43.amzn2.1.4.aarch64
    poppler-cpp-devel-0.26.5-43.amzn2.1.4.aarch64
    poppler-utils-0.26.5-43.amzn2.1.4.aarch64
    poppler-demos-0.26.5-43.amzn2.1.4.aarch64
    poppler-debuginfo-0.26.5-43.amzn2.1.4.aarch64

i686:
    poppler-0.26.5-43.amzn2.1.4.i686
    poppler-devel-0.26.5-43.amzn2.1.4.i686
    poppler-glib-0.26.5-43.amzn2.1.4.i686
    poppler-glib-devel-0.26.5-43.amzn2.1.4.i686
    poppler-qt-0.26.5-43.amzn2.1.4.i686
    poppler-qt-devel-0.26.5-43.amzn2.1.4.i686
    poppler-cpp-0.26.5-43.amzn2.1.4.i686
    poppler-cpp-devel-0.26.5-43.amzn2.1.4.i686
    poppler-utils-0.26.5-43.amzn2.1.4.i686
    poppler-demos-0.26.5-43.amzn2.1.4.i686
    poppler-debuginfo-0.26.5-43.amzn2.1.4.i686

src:
    poppler-0.26.5-43.amzn2.1.4.src

x86_64:
    poppler-0.26.5-43.amzn2.1.4.x86_64
    poppler-devel-0.26.5-43.amzn2.1.4.x86_64
    poppler-glib-0.26.5-43.amzn2.1.4.x86_64
    poppler-glib-devel-0.26.5-43.amzn2.1.4.x86_64
    poppler-qt-0.26.5-43.amzn2.1.4.x86_64
    poppler-qt-devel-0.26.5-43.amzn2.1.4.x86_64
    poppler-cpp-0.26.5-43.amzn2.1.4.x86_64
    poppler-cpp-devel-0.26.5-43.amzn2.1.4.x86_64
    poppler-utils-0.26.5-43.amzn2.1.4.x86_64
    poppler-demos-0.26.5-43.amzn2.1.4.x86_64
    poppler-debuginfo-0.26.5-43.amzn2.1.4.x86_64

Additional References

Red Hat: CVE-2020-18839, CVE-2022-37050

Mitre: CVE-2020-18839, CVE-2022-37050

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started