CVE-2017-14977: Null Pointer Dereference
Published Oct 1, 2017
·Updated
The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.
Affected Software
5 affected componentsFixes available
debian/poppler
0.71.0-50.71.0-5+deb10u320.09.0-3.1+deb11u122.12.0-2
Freedesktop poppler=0.59.0
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Event History
Oct 1, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14977?
CVE-2017-14977 has a severity level of medium due to its potential to cause a denial of service.
2
How do I fix CVE-2017-14977?
To fix CVE-2017-14977, upgrade to Poppler version 0.71.0-5 or later.
3
What types of attacks are possible with CVE-2017-14977?
CVE-2017-14977 may allow attackers to launch denial of service attacks by exploiting a NULL pointer dereference.
4
Which versions of Poppler are affected by CVE-2017-14977?
CVE-2017-14977 affects Poppler version 0.59.0 and potentially earlier versions.
5
Is CVE-2017-14977 specific to any operating system?
CVE-2017-14977 is particularly relevant to Debian Linux distributions, including versions 7.0, 8.0, and 9.0.