CVE-2018-13988: Medium severity Freedesktop poppler vulnerability

Q: What is CVE-2018-13988?

CVE-2018-13988 is an out of bounds read vulnerability in Poppler through 0.62, which can result in memory corruption and denial of service.

Q: Which software is affected by CVE-2018-13988?

CVE-2018-13988 affects Poppler versions 0.41.0-0ubuntu1.8, 0.62.0-2ubuntu2.2, 0.24.5-2ubuntu4.12, 0.67.0, 0.71.0-5, 0.71.0-5+deb10u3, 20.09.0-3.1+deb11u1, and 22.12.0-2.

Q: What is the severity of CVE-2018-13988?

CVE-2018-13988 has a severity rating of 6.5 (medium).

Q: How can CVE-2018-13988 be exploited?

CVE-2018-13988 can be exploited when a victim opens a specially crafted PDF file.

Q: Is there a fix available for CVE-2018-13988?

Yes, remedy packages are available for the affected versions of Poppler. Please refer to the official sources for the specific fixes.

Published Jul 18, 2018

Updated

An out-of-bounds read flaw was found in the Poppler library as demonstrated by pdfunite. This may result in a denial of service or other undefined behavior. This flaw may be exploitable when a victim opens a specially crafted PDF file.

Upstream Patch: https://cgit.freedesktop.org/poppler/poppler/commit/?id=004e3c10df0abda214f0c293f9e269fdd979c5ee

Other sources

Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.

— Launchpad

Affected Software

12 affected componentsFixes available

redhat/poppler<0.67.0

0.67.0

Freedesktop poppler<=0.62.0

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Debian Debian Linux=8.0

redhat Ansible Tower=3.3.0

redhat OpenShift Container Platform=3.11

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Workstation=7.0

debian/poppler

20.09.0-3.1+deb11u120.09.0-3.1+deb11u222.12.0-2+deb12u125.03.0-5+deb13u225.03.0-11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/poppler to a version that resolves this vulnerability.
Fixed in 0.67.0
Upgrade
Upgrade debian/poppler to a version that resolves this vulnerability.
Fixed in 20.09.0-3.1+deb11u1Fixed in 20.09.0-3.1+deb11u2Fixed in 22.12.0-2+deb12u1Fixed in 25.03.0-5+deb13u2Fixed in 25.03.0-11.1
Upgrade
Upgrade Poppler to a version that resolves this vulnerability.
Patch 004e3c10df0abda214f0c293f9e269fdd979c5ee

Event History

Jul 25, 2018

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Data Sourced

via NVD·11:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-13988?

CVE-2018-13988 is an out of bounds read vulnerability in Poppler through 0.62, which can result in memory corruption and denial of service.

Which software is affected by CVE-2018-13988?