REDHAT-BUG-1665273
First published: Thu Jan 10 2019(Updated: )
A flaw was found in Poppler 0.72.0. The PDFDoc::setup class in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. References: <a href="https://gitlab.freedesktop.org/poppler/poppler/issues/706">https://gitlab.freedesktop.org/poppler/poppler/issues/706</a> Upstream Patch: <a href="https://gitlab.freedesktop.org/poppler/poppler/commit/9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f">https://gitlab.freedesktop.org/poppler/poppler/commit/9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Poppler Utilities |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.freedesktop.org/poppler/poppler/issues/706
- https://gitlab.freedesktop.org/poppler/poppler/commit/9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1665275
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1665274
- https://gitlab.freedesktop.org/poppler/poppler/commit/1e99a1eeb3a144facf45165df9f457796c045daa
- https://gitlab.freedesktop.org/poppler/poppler/issues/706#note_99000
- https://access.redhat.com/errata/RHSA-2019:2022
- https://access.redhat.com/security/cve/cve-2018-20662
- https://access.redhat.com/errata/RHSA-2019:2713
- https://bugzilla.redhat.com/show_bug.cgi?id=1665273
Frequently Asked Questions
What is the severity of REDHAT-BUG-1665273?
The severity of REDHAT-BUG-1665273 is classified as high due to its potential to cause denial-of-service by crashing the application.
How do I fix REDHAT-BUG-1665273?
To fix REDHAT-BUG-1665273, upgrade to the latest version of Poppler where the flaw has been patched.
What software is affected by REDHAT-BUG-1665273?
REDHAT-BUG-1665273 affects Poppler, specifically version 0.72.0 and earlier.
What type of vulnerability is REDHAT-BUG-1665273?
REDHAT-BUG-1665273 is a denial-of-service vulnerability caused by a flaw in handling the xref data structure in PDF documents.
Who can exploit REDHAT-BUG-1665273?
Any attacker can exploit REDHAT-BUG-1665273 by crafting a malicious PDF file to trigger the vulnerability.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-20662
- agent/source
- agent/severity
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/poppler
- canonical/poppler utilities