In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in     Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF     document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service     or possibly unspecified other impact. (CVE-2019-16115)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3399-1 advisory.

  - In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in     Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF     document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service     or possibly unspecified other impact. (CVE-2019-16115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3303-1 advisory.

  - In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in     Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF     document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service     or possibly unspecified other impact. (CVE-2019-16115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3292-1 advisory.

  - In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in     Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF     document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service     or possibly unspecified other impact. (CVE-2019-16115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3241-1 advisory.

  - In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in     Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF     document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service     or possibly unspecified other impact. (CVE-2019-16115)

  - In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry     function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly     have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. (CVE-2019-7310)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255484	Linux Distros Unpatched Vulnerability : CVE-2019-16115	Nessus	Misc.	high
180152	SUSE SLES12 Security Update : poppler (SUSE-SU-2023:3399-1)	Nessus	SuSE Local Security Checks	high
179826	SUSE SLES12 Security Update : poppler (SUSE-SU-2023:3303-1)	Nessus	SuSE Local Security Checks	high
179720	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : poppler (SUSE-SU-2023:3292-1)	Nessus	SuSE Local Security Checks	high
179585	openSUSE 15 Security Update : poppler (SUSE-SU-2023:3241-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-16115

high

Tenable Plugins

high

high

high

high

high