CVE-2024-6239: Poppler: pdfinfo: crash in broken documents when using -dests parameter
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.
Other sources
A vulnerability in Poppler's pdfinfo causes the program to crash when processing certain malformed input files. A denial of service by crashing the pdfinfo program.
Component affected: Poppler's pdfinfo utility.
Version affected: <= 24.06.0
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1489 https://gitlab.freedesktop.org/poppler/poppler/-/commit/0554731052d1a97745cb179ab0d45620589dd9c4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/popplerto a version that resolves this vulnerability.Fixed in 24.06.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6239?
CVE-2024-6239 has been assessed as a denial of service vulnerability due to a flaw in the Pdfinfo utility of Poppler.
How do I fix CVE-2024-6239?
To address CVE-2024-6239, update Poppler to version 24.06.0 or later if you are using Red Hat, and for other distributions, ensure your version is updated beyond the vulnerable versions.
Which software is affected by CVE-2024-6239?
CVE-2024-6239 affects various versions of the Poppler utility, especially those prior to 24.06.0.
Can CVE-2024-6239 be exploited remotely?
CVE-2024-6239 can potentially be exploited by attackers who can provide malformed input files to the Pdfinfo utility.
What are the potential impacts of CVE-2024-6239?
The exploitation of CVE-2024-6239 can lead to application crashes, resulting in a denial of service condition.