CVE-2020-35702: Buffer Overflow

Published Dec 25, 2020

Updated

DISPUTED DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects.

Affected Software

1 affected component

Freedesktop poppler=20.12.1

Event History

Dec 25, 2020

CVE Published

via MITRE·01:02 AM

Data Sourced

via MITRE·01:02 AM

Description

Disputed

02:15 AM

Frequently Asked Questions

What is CVE-2020-35702?

CVE-2020-35702 is a vulnerability in Poppler 20.12.1 that allows a crafted PDF document to cause a heap-based buffer overflow in the DCTStream::getChars function in DCTStream.cc.

How severe is CVE-2020-35702?

CVE-2020-35702 has a severity rating of 7.8 (high).

Which software versions are affected by CVE-2020-35702?

Poppler 20.12.1 is affected by CVE-2020-35702.

How can CVE-2020-35702 be exploited?

CVE-2020-35702 can be exploited by using a crafted PDF document.

Is there a fix available for CVE-2020-35702?

The fix for CVE-2020-35702 is available in later builds of Poppler git clones from late December 2020.