Red Hat Security AdvisoryRHSA-2020:1074
poppler and evince security update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) evince-3.28.2-9.el7, evince-dvi-3.28.2-9.el7, evince-libs-3.28.2-9.el7 +5
- Red Hat Enterprise Linux Client Optional (v. 7) evince-browser-plugin-3.28.2-9.el7, evince-devel-3.28.2-9.el7, poppler-cpp-0.26.5-42.el7 +5
- Red Hat Enterprise Linux ComputeNode (v. 7) poppler-0.26.5-42.el7, poppler-qt-0.26.5-42.el7, poppler-utils-0.26.5-42.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) poppler-cpp-0.26.5-42.el7, poppler-cpp-devel-0.26.5-42.el7, poppler-demos-0.26.5-42.el7 +4
- Red Hat Enterprise Linux Server (v. 7) evince-3.28.2-9.el7, evince-dvi-3.28.2-9.el7, evince-libs-3.28.2-9.el7 +8
- Red Hat Enterprise Linux Server Optional (v. 7) evince-browser-plugin-3.28.2-9.el7, evince-devel-3.28.2-9.el7, evince-devel-3.28.2-9.el7.ppc +13
- Red Hat Enterprise Linux Workstation (v. 7) evince-3.28.2-9.el7, evince-dvi-3.28.2-9.el7, evince-libs-3.28.2-9.el7 +5
- Red Hat Enterprise Linux Workstation Optional (v. 7) evince-browser-plugin-3.28.2-9.el7, evince-devel-3.28.2-9.el7, poppler-cpp-0.26.5-42.el7 +5
Fixes 5 records
Priority MEDIUM 42
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02094 · Published 2019-05-23 · Partial fix CWE-125
Priority MEDIUM 42
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01894 · Published 2019-09-05 · Partial fix CWE-190
Priority LOW 34
An issue was discovered in Poppler 0.74.0.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02486 · Published 2019-04-05 · Fixed CWE-125
Priority LOW 33
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01907 · Published 2019-07-22 · Partial fix CWE-190
Priority LOW 28
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory u…
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01443 · Published 2019-04-22 · Partial fix CWE-754
THREATIST.IORead the docs