REDHAT-BUG-1665259: Low severity poppler data vulnerability

Published Jan 10, 2019

Updated

A flaw was found in Poppler 0.72.0. A reachable Object::getString assertion allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/703

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/mergerequests/146

Affected Software

1 affected component

Poppler Poppler

Event History

Jan 10, 2019

Data Sourced

via Red Hat·08:03 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1665259?

The severity of REDHAT-BUG-1665259 is classified as critical due to its potential to cause denial of service.

How do I fix REDHAT-BUG-1665259?

To fix REDHAT-BUG-1665259, update Poppler to the latest version where the vulnerability has been addressed.

What software is affected by REDHAT-BUG-1665259?

Poppler version 0.72.0 and possibly earlier versions are affected by REDHAT-BUG-1665259.

What type of attack is possible with REDHAT-BUG-1665259?

REDHAT-BUG-1665259 allows attackers to perform a denial of service attack by exploiting invalid rich media annotations.

Is there a workaround for REDHAT-BUG-1665259?

Currently, there are no documented workarounds for REDHAT-BUG-1665259 aside from applying the software update.