CVE-2019-9543: High severity poppler data vulnerability

Published Mar 1, 2019

Updated

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.

Affected Software

1 affected component

Freedesktop poppler=0.74.0

Event History

Mar 1, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2019-9543?

CVE-2019-9543 is a vulnerability discovered in Poppler 0.74.0 that allows an attacker to cause Denial of Service or potentially execute arbitrary code.

How severe is CVE-2019-9543?

CVE-2019-9543 has a severity score of 8.8, indicating a high severity.

How can CVE-2019-9543 be exploited?

CVE-2019-9543 can be exploited by sending a crafted PDF file to an affected binary, such as the pdfseparate tool.

What is the affected software for CVE-2019-9543?

The affected software for CVE-2019-9543 is Poppler 0.74.0.

Is there a fix available for CVE-2019-9543?

Yes, a fix is available for CVE-2019-9543. Users should update to a version of Poppler that is not affected by the vulnerability.