REDHAT-BUG-1683632: Medium severity poppler data vulnerability

Published Feb 27, 2019

Updated

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/728

Affected Software

1 affected component

Poppler Poppler

Event History

Feb 27, 2019

Data Sourced

via Red Hat·12:23 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1683632?

The severity of REDHAT-BUG-1683632 is significant due to its potential to cause Denial of Service through segmentation faults.

How do I fix REDHAT-BUG-1683632?

To fix REDHAT-BUG-1683632, you should update to the latest version of Poppler where the vulnerability is patched.

What type of vulnerability is REDHAT-BUG-1683632?

REDHAT-BUG-1683632 is a heap-based buffer underwrite vulnerability.

What software is affected by REDHAT-BUG-1683632?

REDHAT-BUG-1683632 affects Poppler version 0.74.0 and potentially earlier versions.

Can REDHAT-BUG-1683632 be exploited remotely?

Yes, REDHAT-BUG-1683632 can be exploited remotely by sending a crafted PDF file to the pdfimages binary.