CVE-2010-3703: Input Validation
poppler git commit bf2055088a corrects a possible use of an uninitialized pointer in PostScriptFunction, which can cause crash or memory corruption.
Upstream git commit: http://cgit.freedesktop.org/poppler/poppler/commit/?id=bf2055088a3a2d3bb3d3c37d464954ec1a25771f
This problem does not affect xpdf or other applications embedding xpdf code. It only affects recent poppler versions, not before commit:
http://cgit.freedesktop.org/poppler/poppler/commit/?id=b1d4efb082ac3dadd7752a557e5aeb6651e17471
Reference: http://secunia.com/advisories/41596/
Other sources
The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3703?
CVE-2010-3703 is classified as a moderate severity vulnerability due to possible crashes or memory corruption.
How do I fix CVE-2010-3703?
To resolve CVE-2010-3703, update Poppler to a version that includes the fix from commit bf2055088a.
Which versions of Poppler are affected by CVE-2010-3703?
CVE-2010-3703 affects multiple Poppler versions, including 0.8.7 to 0.15.1, specifically those mentioned in the vulnerability details.
What type of vulnerability is CVE-2010-3703?
CVE-2010-3703 is a security vulnerability that relates to the possible use of an uninitialized pointer in the Poppler library.
Is there any exploit available for CVE-2010-3703?
There is no publicly known exploit for CVE-2010-3703, but the risk of crashes or memory corruption remains.