Red Hat Security AdvisoryRHSA-2019:2022
poppler security, bug fix, and enhancement update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) evince-3.28.2-8.el7, evince-dvi-3.28.2-8.el7, evince-libs-3.28.2-8.el7 +8
- Red Hat Enterprise Linux Client Optional (v. 7) evince-browser-plugin-3.28.2-8.el7, evince-devel-3.28.2-8.el7, okular-devel-4.10.5-7.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) poppler-0.26.5-38.el7, poppler-qt-0.26.5-38.el7, poppler-utils-0.26.5-38.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) poppler-cpp-0.26.5-38.el7, poppler-cpp-devel-0.26.5-38.el7, poppler-demos-0.26.5-38.el7 +4
- Red Hat Enterprise Linux Server (v. 7) evince-3.28.2-8.el7, evince-dvi-3.28.2-8.el7, evince-libs-3.28.2-8.el7 +12
- Red Hat Enterprise Linux Server Optional (v. 7) evince-browser-plugin-3.28.2-8.el7, evince-devel-3.28.2-8.el7, evince-devel-3.28.2-8.el7.ppc +13
- Red Hat Enterprise Linux Workstation (v. 7) evince-3.28.2-8.el7, evince-dvi-3.28.2-8.el7, evince-libs-3.28.2-8.el7 +9
- Red Hat Enterprise Linux Workstation Optional (v. 7) evince-browser-plugin-3.28.2-8.el7, evince-devel-3.28.2-8.el7, poppler-cpp-0.26.5-38.el7 +5
Fixes 12 records
Priority MEDIUM 48
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03518 · Published 2019-03-08 · Partial fix CWE-125
Priority MEDIUM 44
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.03473 · Published 2019-02-26 · Fixed CWE-787
Priority LOW 38
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have un…
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.02073 · Published 2019-02-03 · Fixed CWE-125
Priority LOW 35
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag i…
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03288 · Published 2018-12-26 · Partial fix CWE-476
Priority LOW 34
A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02577 · Published 2019-01-01 · Partial fix CWE-20
Priority LOW 34
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02444 · Published 2018-11-10 · Fixed CWE-476
Priority LOW 34
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02882 · Published 2018-09-06 · Partial fix CWE-835
Priority LOW 33
In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in whi…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02262 · Published 2019-01-03 · Partial fix CWE-20
Priority LOW 33
An issue was discovered in Poppler 0.71.0.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01836 · Published 2018-11-07 · Fixed CWE-125
Priority LOW 33
An issue was discovered in Poppler 0.71.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01865 · Published 2018-11-07 · Fixed CWE-670
Priority LOW 33
An issue was discovered in Poppler 0.71.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01955 · Published 2018-11-02 · Partial fix CWE-772
Priority LOW 32
An issue was discovered in Poppler 0.71.0.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01735 · Published 2018-11-07 · Fixed CWE-476
THREATIST.IORead the docs