REDHAT-BUG-1691724: Low severity poppler data vulnerability

Published Mar 22, 2019

Updated

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/741

Upstream commit: https://gitlab.freedesktop.org/poppler/poppler/commit/fada09a2ccc11a3a1d308e810f1336d8df6011fd

Affected Software

1 affected component

Poppler Poppler=0.74.0

Event History

Mar 22, 2019

Data Sourced

via Red Hat·10:45 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1691724?

The severity of REDHAT-BUG-1691724 is classified as critical due to potential stack consumption leading to denial of service.

How do I fix REDHAT-BUG-1691724?

To fix REDHAT-BUG-1691724, upgrade Poppler to version 0.74.1 or later where the vulnerability is addressed.

What versions of Poppler are affected by REDHAT-BUG-1691724?

Poppler version 0.74.0 is affected by REDHAT-BUG-1691724.

How can REDHAT-BUG-1691724 be exploited?

REDHAT-BUG-1691724 can be exploited by processing a crafted PDF file using the pdfunite binary.

What components are involved in the vulnerability REDHAT-BUG-1691724?

The vulnerability REDHAT-BUG-1691724 involves the PDFDoc::markObject function and Dict::find() method in Poppler.