Published: 23/11/2013 Updated: 31/12/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler prior to 0.24.3 allows remote malicious users to cause a denial of service (crash) via format string specifiers in a destination filename.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 15.10
freedesktop poppler 0.24.0
freedesktop poppler 0.23.4
freedesktop poppler 0.1
freedesktop poppler 0.1.1
freedesktop poppler 0.10.5
freedesktop poppler 0.10.6
freedesktop poppler 0.12.2
freedesktop poppler 0.12.3
freedesktop poppler 0.14.0
freedesktop poppler 0.14.1
freedesktop poppler 0.15.2
freedesktop poppler 0.15.3
freedesktop poppler 0.16.7
freedesktop poppler 0.17.0
freedesktop poppler 0.18.2
freedesktop poppler 0.18.3
freedesktop poppler 0.2.0
freedesktop poppler 0.20.0
freedesktop poppler 0.20.1
freedesktop poppler 0.21.2
freedesktop poppler 0.21.3
freedesktop poppler 0.3.2
freedesktop poppler 0.3.3
freedesktop poppler 0.5.1
freedesktop poppler 0.5.2
freedesktop poppler 0.23.1
freedesktop poppler 0.23.0
freedesktop poppler 0.10.1
freedesktop poppler 0.10.2
freedesktop poppler 0.11.1
freedesktop poppler 0.11.2
freedesktop poppler 0.11.3
freedesktop poppler 0.13.1
freedesktop poppler 0.13.2
freedesktop poppler 0.14.4
freedesktop poppler 0.14.5
freedesktop poppler 0.16.3
freedesktop poppler 0.16.4
freedesktop poppler 0.17.3
freedesktop poppler 0.17.4
freedesktop poppler 0.19.1
freedesktop poppler 0.19.2
freedesktop poppler 0.20.4
freedesktop poppler 0.20.5
freedesktop poppler 0.22.1
freedesktop poppler 0.22.2
freedesktop poppler 0.4.2
freedesktop poppler 0.4.3
freedesktop poppler 0.5.90
freedesktop poppler 0.5.91
freedesktop poppler 0.7.1
freedesktop poppler 0.7.2
freedesktop poppler 0.8.5
freedesktop poppler 0.8.6
freedesktop poppler
freedesktop poppler 0.22.4
freedesktop poppler 0.22.3
freedesktop poppler 0.10.3
freedesktop poppler 0.10.4
freedesktop poppler 0.12.0
freedesktop poppler 0.12.1
freedesktop poppler 0.13.3
freedesktop poppler 0.13.4
freedesktop poppler 0.15.0
freedesktop poppler 0.15.1
freedesktop poppler 0.16.5
freedesktop poppler 0.16.6
freedesktop poppler 0.18.0
freedesktop poppler 0.18.1
freedesktop poppler 0.19.3
freedesktop poppler 0.19.4
freedesktop poppler 0.21.0
freedesktop poppler 0.21.1
freedesktop poppler 0.3.0
freedesktop poppler 0.3.1
freedesktop poppler 0.4.4
freedesktop poppler 0.5.0
freedesktop poppler 0.6.0
freedesktop poppler 0.6.1
freedesktop poppler 0.7.3
freedesktop poppler 0.8.0
freedesktop poppler 0.8.7
freedesktop poppler 0.9.0
freedesktop poppler 0.9.1
freedesktop poppler 0.23.3
freedesktop poppler 0.23.2
freedesktop poppler 0.1.2
freedesktop poppler 0.10.0
freedesktop poppler 0.10.7
freedesktop poppler 0.11.0
freedesktop poppler 0.12.4
freedesktop poppler 0.13.0
freedesktop poppler 0.14.2
freedesktop poppler 0.14.3
freedesktop poppler 0.16.0
freedesktop poppler 0.16.1
freedesktop poppler 0.16.2
freedesktop poppler 0.17.1
freedesktop poppler 0.17.2
freedesktop poppler 0.18.4
freedesktop poppler 0.19.0
freedesktop poppler 0.20.2
freedesktop poppler 0.20.3
freedesktop poppler 0.21.4
freedesktop poppler 0.22.0
freedesktop poppler 0.4.0
freedesktop poppler 0.4.1
freedesktop poppler 0.5.4
freedesktop poppler 0.5.9
freedesktop poppler 0.6.4
freedesktop poppler 0.7.0
freedesktop poppler 0.8.3
freedesktop poppler 0.8.4
freedesktop poppler 0.5.3
freedesktop poppler 0.6.2
freedesktop poppler 0.6.3
freedesktop poppler 0.8.1
freedesktop poppler 0.8.2
freedesktop poppler 0.9.2
freedesktop poppler 0.9.3

Debian Bug report logs - #729064 poppler: CVE-2013-4473 CVE-2013-4474 Package: poppler; Maintainer for poppler is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Fri, 8 Nov 2013 13:42:01 UTC Severity: important Tags: pat ...

poppler could be made to crash or run programs if it opened a specially crafted file ...

Format string vulnerability in the extractPages function in utils/pdfseparatecc in poppler before 0243 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename ...

source: wwwsecurityfocuscom/bid/63374/info Poppler is prone to a local format-string vulnerability because it fails to sanitize user-supplied input An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application Failed exploit attempts will likely result in a denial-of-service condition Versi ...

CWE-20 http://bugs.debian.org/723124 http://www.openwall.com/lists/oss-security/2013/10/29/1 http://cgit.freedesktop.org/poppler/poppler/commit/?id=61f79b8447c3ac8ab5a26e79e0c28053ffdccf75 https://bugs.freedesktop.org/show_bug.cgi?id=69434 http://secunia.com/advisories/56567 http://security.gentoo.org/glsa/glsa-201401-21.xml http://www.ubuntu.com/usn/USN-2958-1 http://www.securityfocus.com/bid/63374 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729064 https://usn.ubuntu.com/2958-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/38817/https://access.redhat.com/security/cve/cve-2013-4474

Get Started

CVE-2013-4474

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect