REDHAT-BUG-1665273: Low severity poppler data vulnerability

Published Jan 10, 2019

Updated

A flaw was found in Poppler 0.72.0. The PDFDoc::setup class in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/706

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/commit/9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f

Affected Software

1 affected component

Poppler Poppler

Event History

Jan 10, 2019

Data Sourced

via Red Hat·08:19 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1665273?

The severity of REDHAT-BUG-1665273 is classified as high due to its potential to cause denial-of-service by crashing the application.

How do I fix REDHAT-BUG-1665273?

To fix REDHAT-BUG-1665273, upgrade to the latest version of Poppler where the flaw has been patched.

What software is affected by REDHAT-BUG-1665273?

REDHAT-BUG-1665273 affects Poppler, specifically version 0.72.0 and earlier.

What type of vulnerability is REDHAT-BUG-1665273?

REDHAT-BUG-1665273 is a denial-of-service vulnerability caused by a flaw in handling the xref data structure in PDF documents.

Who can exploit REDHAT-BUG-1665273?

Any attacker can exploit REDHAT-BUG-1665273 by crafting a malicious PDF file to trigger the vulnerability.