REDHAT-BUG-1649450: Null Pointer Dereference

Published Nov 13, 2018

Updated

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/660

Affected Software

1 affected component

Poppler Poppler

Event History

Nov 13, 2018

Data Sourced

via Red Hat·04:09 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1649450?

The severity of REDHAT-BUG-1649450 is categorized as denial of service due to a NULL pointer dereference.

How do I fix REDHAT-BUG-1649450?

To fix REDHAT-BUG-1649450, it is recommended to upgrade to a later version of Poppler that addresses this vulnerability.

What software is affected by REDHAT-BUG-1649450?

REDHAT-BUG-1649450 affects Poppler version 0.71.0.

What is the impact of REDHAT-BUG-1649450?

The impact of REDHAT-BUG-1649450 is a potential denial of service that may occur when an embedded file's filename is not validated.

Is there a workaround for REDHAT-BUG-1649450?

Currently, there is no documented workaround for REDHAT-BUG-1649450; the best action is to upgrade the software.