REDHAT-BUG-526924: Integer Overflow
First published: Fri Oct 02 2009(Updated: )
Ludwig Nussel reported an integer overflow in poppler's create_surface_from_thumbnail_data() function. cairo_pixels buffer is allocated as: cairo_pixels = (guchar *)g_malloc (4 * width * height); <a href="http://cgit.freedesktop.org/poppler/poppler/tree/glib/poppler-page.cc#n615">http://cgit.freedesktop.org/poppler/poppler/tree/glib/poppler-page.cc#n615</a> where width / height is read from PDF file. Some validation of the values is done in Page::loadThumb(), but it is not sufficient to prevent the overflow: if (width > INT_MAX / 3 / height) <a href="http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Page.cc#n547">http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Page.cc#n547</a> This code does not exist in poppler as shipped in EL5, nor it is part of xpdf.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Poppler Data |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cgit.freedesktop.org/poppler/poppler/tree/glib/poppler-page.cc#n615
- http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Page.cc#n547
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=526924#c17
- http://cgit.freedesktop.org/poppler/poppler/commit/?id=c839b706
- http://admin.fedoraproject.org/updates/poppler-0.8.7-7.fc10
- http://admin.fedoraproject.org/updates/poppler-0.10.7-3.fc11
- https://access.redhat.com/security/cve/CVE-2009-3907
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3907
- https://access.redhat.com/security/cve/CVE-2009-3607
- https://bugzilla.redhat.com/show_bug.cgi?id=526924
Frequently Asked Questions
What is the severity of REDHAT-BUG-526924?
The severity of REDHAT-BUG-526924 is high due to the potential for an integer overflow leading to memory corruption.
How do I fix REDHAT-BUG-526924?
To fix REDHAT-BUG-526924, update your Poppler package to a version that includes the patch for the integer overflow issue.
Which software is affected by REDHAT-BUG-526924?
The affected software for REDHAT-BUG-526924 is Poppler, specifically in its create_surface_from_thumbnail_data() function.
Can REDHAT-BUG-526924 lead to security vulnerabilities?
Yes, REDHAT-BUG-526924 can lead to security vulnerabilities by allowing potential exploitation through memory corruption.
Is there a workaround for REDHAT-BUG-526924 until I can apply a patch?
A potential workaround for REDHAT-BUG-526924 is to limit the input data size to prevent triggering the integer overflow.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-3607
- agent/source
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/poppler
- canonical/poppler data