Red Hat Security Advisory

RHSA-2009:0480

poppler security update

Released 2009-05-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) poppler-0.5.4-4.4.el5_3.9, poppler-0.5.4-4.4.el5_3.9.i386, poppler-0.5.4-4.4.el5_3.9.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) poppler-0.5.4-4.4.el5_3.9, poppler-0.5.4-4.4.el5_3.9.i386, poppler-utils-0.5.4-4.4.el5_3.9 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) poppler-0.5.4-4.4.el5_3.9, poppler-devel-0.5.4-4.4.el5_3.9, poppler-devel-0.5.4-4.4.el5_3.9.i386

Fixes 16 records

TI-2009-03443 CVE-2009-3606 · GHSA-75g3-x63m-xg86

Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and…

MEDIUM 51

Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that trig…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08629 Published 2009-10-21 Fixed CWE-189

TI-2009-03441 CVE-2009-3604 · GHSA-57v7-6q2r-896j

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and…

MEDIUM 51

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08703 Published 2009-10-21 Fixed CWE-399

TI-2009-01122 CVE-2009-1182 · GHSA-rc72-3q8m-vx43

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS…

MEDIUM 43

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07347 Published 2009-04-23 Fixed CWE-119

TI-2009-01119 CVE-2009-1179 · GHSA-p2p8-hc72-rjjm

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and…

LOW 39

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05549 Published 2009-04-23 Fixed CWE-189

TI-2009-00753 CVE-2009-0791 · GHSA-89xf-5fpv-6xg6

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops…

LOW 39

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (applicatio…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05544 Published 2009-06-09 Fixed CWE-189

TI-2009-01120 CVE-2009-1180 · GHSA-xx2p-3xq8-p2xm

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 38

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid da…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05411 Published 2009-04-23 Fixed CWE-399

TI-2009-00760 CVE-2009-0800 · GHSA-x57h-fgf6-293f

Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS…

LOW 38

Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF fil…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05491 Published 2009-04-23 Fixed CWE-20

TI-2009-00182 CVE-2009-0195 · GHSA-fvm9-xxrq-gwmc

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other…

LOW 38

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05374 Published 2009-04-23 Fixed CWE-119

TI-2009-01128 CVE-2009-1188 · GHSA-33p4-7h6v-86r2

Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function…

LOW 33

Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attac…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07233 Published 2009-04-23 Fixed CWE-189

TI-2009-01127 CVE-2009-1187 · GHSA-xr2j-w2jp-cp5m

Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote…

LOW 33

Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputD…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07172 Published 2009-04-23 Fixed CWE-189

TI-2009-01123 CVE-2009-1183 · GHSA-mgw7-6f2m-wg36

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 27

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0377 Published 2009-04-23 Fixed CWE-399

TI-2009-01121 CVE-2009-1181 · GHSA-2hrx-xwqf-pfcv

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 27

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL po…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03803 Published 2009-04-23 Fixed CWE-399

TI-2009-00759 CVE-2009-0799 · GHSA-whhp-65p4-rw8g

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 27

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0377 Published 2009-04-23 Fixed CWE-119

TI-2009-00155 CVE-2009-0166 · GHSA-7727-7vvq-m43f

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products…

LOW 25

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02318 Published 2009-04-23 Fixed CWE-399

TI-2009-00136 CVE-2009-0147 · GHSA-6336-f8r9-rhcv

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9…

LOW 25

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) J…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02577 Published 2009-04-23 Fixed CWE-189

TI-2009-00135 CVE-2009-0146 · GHSA-29f7-44gf-pv93

Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9…

LOW 25

Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JB…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02833 Published 2009-04-23 Fixed CWE-119