5.5
CVSSv3

CVE-2017-18267

Published: 10/05/2018 Updated: 23/07/2020
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler up to and including 0.64.0 allows remote malicious users to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

freedesktop poppler

canonical ubuntu linux 17.10

canonical ubuntu linux 18.04

canonical ubuntu linux 14.04

canonical ubuntu linux 16.04

redhat ansible tower 3.3

redhat enterprise linux workstation 7.0

redhat enterprise linux server 7.0

redhat enterprise linux desktop 7.0

debian debian linux 8.0

Vendor Advisories

Debian Bug report logs - #898357 poppler: CVE-2017-18267: infinite loop in FoFiType1C::cvtGlyph in FoFiType1Ccc Package: src:poppler; Maintainer for src:poppler is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, ...
poppler could be made to crash if it opened a specially crafted PDF ...
Synopsis Moderate: GNOME security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Critical: Red Hat Ansible Tower 331-2 Release - Container Image Type/Severity Security Advisory: Critical Topic Security Advisory Description Red Hat Ansible Tower 331 is now available and contains the following bug fixes: Fixed event callback error when in-line vaulted variabl ...
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annoth A crafted input will lead to a remote denial of service attack Poppler versions later than 0410 are not affected(CVE-2018-10768) The FoFiType1C::cvtGlyph function in fofi/FoFiType1Ccc in Poppler allows remote attackers to cause a denial of service (infin ...
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annoth A crafted input will lead to a remote denial of service attack(CVE-2018-10768) The FoFiType1C::cvtGlyph function in fofi/FoFiType1Ccc in Poppler allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrate ...