Published: 07/07/2008 Updated: 11/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and previous versions deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote malicious users to execute arbitrary code via a crafted PDF document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
poppler poppler

Debian Bug report logs - #489756 poppler: CVE-2008-2950 arbitrary code execution Package: libpoppler3; Maintainer for libpoppler3 is (unknown); Reported by: Nico Golde <nion@debianorg> Date: Mon, 7 Jul 2008 15:33:18 UTC Severity: grave Tags: patch, security Fixed in versions 082-2+lenny1, poppler/084-11 Done: Nico ...

Felipe Andres Manzano discovered that poppler did not correctly initialize certain page widgets If a user were tricked into viewing a malicious PDF file, a remote attacker could exploit this to crash applications linked against poppler, leading to a denial of service ...

########################################################################## #### Felipe Andres Manzano * fmanzano@fceiaunreduar #### #### updates in felipeandresmanzanogooglepagescom/home #### ########################################################################## ''' Sumary: ======= The libpoppler pdf renderin ...

The libpoppler pdf rendering library can free uninitialized pointers leading to arbitrary code execution This vulnerability results from memory management bugs in the Page class constructor/destructor Proof of concept code included ...

CWE-94 http://www.ocert.org/advisories/ocert-2008-007.html http://secunia.com/advisories/30963 http://www.securityfocus.com/bid/30107 http://www.securitytracker.com/id?1020435 http://www.ubuntu.com/usn/usn-631-1 http://secunia.com/advisories/31002 http://secunia.com/advisories/31267 http://secunia.com/advisories/31405 http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:146 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00161.html http://security.gentoo.org/glsa/glsa-200807-04.xml http://wiki.rpath.com/Advisories:rPSA-2008-0223 http://securityreason.com/securityalert/3977 http://www.vupen.com/english/advisories/2008/2024/references http://secunia.com/advisories/31167 https://exchange.xforce.ibmcloud.com/vulnerabilities/43619 https://www.exploit-db.com/exploits/6032 http://www.securityfocus.com/archive/1/494142/100/0/threaded http://www.securityfocus.com/archive/1/493980/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489756 https://usn.ubuntu.com/631-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/6032/

CVE-2008-2950

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect