XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.(CVE-2018-20481)

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. (CVE-2018-16646)

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.(CVE-2019-9631)

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.(CVE-2018-20650)

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.(CVE-2018-19059)

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.(CVE-2018-19058)

Poppler before 0.70.0 has a NULL pointer dereference in
_poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.(CVE-2018-19149)

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.(CVE-2019-7310)

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.(CVE-2018-18897)

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.(CVE-2018-19060)

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.(CVE-2019-9200)

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.(CVE-2018-20662)

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3854-1 advisory.

  - The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers     to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
    (CVE-2017-18267)

  - Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that     is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and     denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
    (CVE-2018-13988)

  - In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted     file. A remote attacker can leverage this for a DoS attack. (CVE-2018-16646)

  - An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in     GfxState.cc, as demonstrated by pdftocairo. (CVE-2018-18897)

  - An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of     service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
    (CVE-2018-19058)

  - An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc,     will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before     save attempts. (CVE-2018-19059)

  - An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will     lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded     file before constructing a save path. (CVE-2018-19060)

  - Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from     poppler_annot_file_attachment_get_attachment. (CVE-2018-19149)

  - XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote     attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when     XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc. (CVE-2018-20481)

  - A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service     due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.
    (CVE-2018-20551)

  - A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service     due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in     FileSpec.cc) in pdfdetach. (CVE-2018-20650)

  - In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application     crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF     file in which an xref data structure is mishandled during extractPDFSubtype processing. (CVE-2018-20662)

  - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function     PSOutputDev::checkPageSlice at PSOutputDev.cc. (CVE-2019-10871)

  - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function     Splash::blitTransparent at splash/Splash.cc. (CVE-2019-10872)

  - An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function     SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. (CVE-2019-14494)

  - In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry     function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly     have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. (CVE-2019-7310)

  - A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0     that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an     attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
    (CVE-2019-9200)

  - Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter     function. (CVE-2019-9631)

  - PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in     the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted     pdf file to the pdfunite binary. (CVE-2019-9903)

  - The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream     length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the     heap, with a size controlled by an attacker, as demonstrated by pdftocairo. (CVE-2019-9959)

  - A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could     exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would     crash the application causing a denial of service. (CVE-2020-27778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2018-16646、CVE-2018-19058、CVE-2018-19059およびCVE-2018-19060のセキュリティ修正。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

Debian 9「Stretch」では、これらの問題はバージョン0.48.0-2+deb9u4で修正されています。

お使いのpopplerパッケージをアップグレードすることを推奨します。

popplerの詳細なセキュリティステータスについては、そのセキュリティトラッカーページを参照してください:
https://security-tracker.debian.org/tracker/poppler

注: Tenable Network Securityは、前述の記述ブロックを DLA セキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートの SUSE Linux SUSE15ホストには、openSUSE-SU-2021:3854-1のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - FoFiType1C: : cvtGlyph 関数 (0.64.0 までの Poppler の fof/FoFiType1C.cc) により、pdftops で実証されているように、リモートの攻撃者が細工された PDF ファイルを介してサービス拒否 (無限再帰) を引き起こす可能性があります。
    (CVE-2017-18267)

  - pdfunite で示されているように、0.62 までの Poppler には、そのメモリ空間にマッピングされていない不正なメモリアクセスに起因する領域外読み取りの脆弱性があります。これにより、メモリの破損とサービス拒否が引き起こされる可能性があります。これは、被害者が特別に細工された PDF ファイルを開くときに悪用される場合があります。
    (CVE-2018-13988)

  - Poppler 0.68.0 では、Parser.cc の Parser: : getObj() 関数が細工されたファイルを介して無限再帰を引き起こす可能性があります。リモート攻撃者は、これを利用して DoS 攻撃を行うことができます (CVE-2018-16646)

  - Poppler 0.71.0で問題が発見されました。pdftocairo で示されているように、GfxState.cc の GfxColorSpace: : etDisplayProfile にメモリリークがあります。(CVE-2018-18897)

  - Poppler 0.71.0 で問題が発見されました。Object.h の到達可能な停止が、サービス拒否を引き起こす可能性があります。FileSpec.cc の EmbFile: : save2 は、埋め込みファイル保存前にストリームをチェックしないことが原因です。
    (CVE-2018-19058)

  - Poppler 0.71.0で問題が発見されました。FileSpec.cc の EmbFile: : save2 に領域外読み取りがあり、保存試行の前に utils/pdfdetach.cc が埋め込みファイルを検証しないことで示されるように、サービス拒否につながります。(CVE-2018-19059)

  - Poppler 0.71.0 で問題が発見されました。goo/GooString.h には NULL ポインターデリファレンスがあり、保存パスを構築する前に utils/pdfdetach.cc が埋め込みファイルのファイル名を検証しないことで示されるように、サービス拒否につながります。(CVE-2018-19060)

  - 0.70.0 より前の Poppler では、poppler_annot_file_attachment_get_attachment から呼び出されたとき、_poppler_attachment_new に NULL ポインターデリファレンスがあります。(CVE-2018-19149)

  - XRef: : :getEntry (Poppler 0.72.0の XRef.cc のもの) は、未割り当ての XRef エントリを不適切に処理するため、XRef.h の XRefEntry: : setFlag が Parser.cc の Parser: : makeStreamから呼び出されたときに、リモートの攻撃者が細工された PDF ドキュメントを介してサービス拒否 (NULLポインターデリファレンス) を引き起こす可能性があります。(CVE-2018-20481)

  - 到達可能な Object: : getString アサーション (Poppler 0.72.0 のもの) により、攻撃者は Annot.c の AnnotRichMedia クラスで無効なリッチメディア注釈アセットを構築することでサービス拒否を引き起こす可能性があります。
    (CVE-2018-20551)

  - 到達可能な Object: : dictLookup アサーション (Poppler 0.72.0 のもの) により、pdfdetach で FileSpec クラス (FileSpec.cc 内) を使用することで示されるように、攻撃者は dict データ型のチェックがないためサービス拒否を引き起こす可能性があります。(CVE-2018-20650)

  - Poppler 0.72.0では、PDFDoc.cc の PDFDoc: : setup により、extractPDFSubtype 処理中に外部参照データ構造が不適切に処理される PDF ファイルを作成することにより、攻撃者がサービス拒否 (PDFDoc: : setup からの誤った戻り値のため、Object.h SIGABRT によって引き起こされるアプリケーションクラッシュ) を引き起こす可能性があります。(CVE-2018-20662)

  - Poppler 0.74.0 で問題が発見されました。PSOutputDev.ccのPSOutputDev: : checkPageSlice には、ヒープベースのバッファオーバーリードがあります。(CVE-2019-10871)

  - Poppler 0.74.0 で問題が発見されました。splash/Splash.cc の Splash: : blitTransparent には、ヒープベースのバッファオーバーリードがあります。(CVE-2019-10872)

  - 0.78.0 までの Poppler で問題が発見されました。SplashOutputDev.cc の関数 SplashOutputDev: : tilingPatternFill には、ゼロ除算エラーがあります。(CVE-2019-14494)

  - Poppler 0.73.0 では、pdftocairo に示されるように、ヒープベースのバッファオーバーリード (XRef.cc の XRef: : getEntry 関数の整数符号エラーにより) サービス拒否 (アプリケーションのクラッシュ) を引き起こしたり、細工された PDF ドキュメントを介してその他の詳細不明の影響を与える可能性があります。(CVE-2019-7310)

  - Stream.cc にある ImageStream: : getLine() (Poppler 0.74.0 のもの) にヒープベースのバッファアンダーライトが存在します。これは、(例えば) 細工された PDF ファイルを pdfimages バイナリに送信することで誘発される可能性があります。攻撃者がサービス拒否 (セグメンテーション違反) を引き起こしたり、詳細不明なその他の影響を及ぼしたりする可能性があります。
    (CVE-2019-9200)

  - Poppler 0.74.0 には、CairoRescaleBox.cc downsample_row_box_filter 関数に、ヒープベースのバッファオーバーリードがあります。(CVE-2019-9631)

  - PDFDoc: : markObject (Poppler 0.74.0 の PDFDoc.cc のもの) は dict マーキングを誤って処理し、Dict.cc にある関数 Dict: : find() のスタック消費を引き起こします。これは、(たとえば) 細工された pdf ファイルを pdfunite バイナリに渡すことでトリガーされます。(CVE-2019-9903)

  - JPXStream: : init 関数 (Poppler 0.78.0 以前) は、ストリーム長の負の値をチェックしないため、整数オーバーフローが発生します。これにより、pdftocairo に示されるとおり攻撃者が制御するサイズのヒープに大きなメモリチャンクが割り当てられる可能性があります。(CVE-2019-9959)

  - 特定の PDF ファイルが HTML に変換される方法において、Poppler に欠陥が見つかりました。リモートの攻撃者がこの欠陥を悪用し、悪意のある PDF ファイルを提供し、「pdftohtml」プログラムで処理されると、アプリケーションがクラッシュし、サービス拒否が引き起こされる可能性があります。(CVE-2020-27778)

Nessus はこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモート Redhat Enterprise Linux 7 ホストに、RHSA-2019:2022 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - poppler: Parser.cc の Parser::getObj 関数での無限再帰 (CVE-2018-16646)

  - poppler: GfxState.cc の GfxColorSpace::setDisplayProfile におけるメモリリーク (CVE-2018-18897)

  - poppler: Object.h の到達可能な停止 (CVE-2018-19058)

  - poppler: FileSpec.cc の EmbFile::save2 の領域外読み取り (CVE-2018-19059)

  - poppler: pdfdetach ユーティリティが保存パスを検証しません (CVE-2018-19060)

  - poppler: _poppler_attachment_new における NULL ポインターデリファレンス (CVE-2018-19149)

  - poppler: XRef.cc の XRef::getEntry の NULL ポインターデリファレンス (CVE-2018-20481)

  - poppler: FileSpec.cc の FileSpec クラスでの到達可能な Object::dictLookup アサーション (CVE-2018-20650)

  - poppler: PDFDoc.cc の SIGABRT PDFDoc::setup クラス (CVE-2018-20662)

  - poppler: XRef.cc の XRef::getEntry のヒープベースのバッファオーバーリード (CVE-2019-7310)

  - poppler: Stream.cc の ImageStream::getLine() 関数のヒープベースのバッファオーバーフロー (CVE-2019-9200)

  - poppler: CairoRescaleBox.cc の downsample_row_box_filter 関数におけるヒープベースのバッファオーバーリード (CVE-2019-9631)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0     mishandles dict marking, leading to stack consumption     in the function Dict::find() located at Dict.cc, which     can (for example) be triggered by passing a crafted pdf     file to the pdfunite binary.(CVE-2019-9903)

  - An issue was discovered in Poppler 0.71.0. There is a     memory leak in GfxColorSpace::setDisplayProfile in     GfxState.cc, as demonstrated by     pdftocairo.(CVE-2018-18897)

  - An issue was discovered in Poppler 0.71.0. There is a     reachable abort in Object.h, will lead to denial of     service because EmbFile::save2 in FileSpec.cc lacks a     stream check before saving an embedded     file.(CVE-2018-19058)

  - An issue was discovered in Poppler 0.71.0. There is a     NULL pointer dereference in goo/GooString.h, will lead     to denial of service, as demonstrated by     utils/pdfdetach.cc not validating a filename of an     embedded file before constructing a save     path.(CVE-2018-19060)

  - An issue was discovered in Poppler 0.71.0. There is a     out-of-bounds read in EmbFile::save2 in FileSpec.cc,     will lead to denial of service, as demonstrated by     utils/pdfdetach.cc not validating embedded files before     save attempts.(CVE-2018-19059)

  - A reachable Object::dictLookup assertion in Poppler     0.72.0 allows attackers to cause a denial of service     due to the lack of a check for the dict data type, as     demonstrated by use of the FileSpec class (in     FileSpec.cc) in pdfdetach.(CVE-2018-20650)

  - An issue was discovered in Poppler 0.74.0. There is a     heap-based buffer over-read in the function     PSOutputDev::checkPageSlice at     PSOutputDev.cc.(CVE-2019-10871)

  - In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows     attackers to cause a denial-of-service (application     crash caused by Object.h SIGABRT, because of a wrong     return value from PDFDoc::setup) by crafting a PDF file     in which an xref data structure is mishandled during     extractPDFSubtype processing.(CVE-2018-20662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-16646, CVE-2018-19058, CVE-2018-19059 and CVE-2018-19060.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

For Debian 9 stretch, these problems have been fixed in version 0.48.0-2+deb9u4.

We recommend that you upgrade your poppler packages.

For the detailed security status of poppler please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/poppler

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3854-1 advisory.

  - The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers     to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
    (CVE-2017-18267)

  - Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that     is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and     denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
    (CVE-2018-13988)

  - In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted     file. A remote attacker can leverage this for a DoS attack. (CVE-2018-16646)

  - An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in     GfxState.cc, as demonstrated by pdftocairo. (CVE-2018-18897)

  - An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of     service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
    (CVE-2018-19058)

  - An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc,     will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before     save attempts. (CVE-2018-19059)

  - An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will     lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded     file before constructing a save path. (CVE-2018-19060)

  - Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from     poppler_annot_file_attachment_get_attachment. (CVE-2018-19149)

  - XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote     attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when     XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc. (CVE-2018-20481)

  - A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service     due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.
    (CVE-2018-20551)

  - A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service     due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in     FileSpec.cc) in pdfdetach. (CVE-2018-20650)

  - In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application     crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF     file in which an xref data structure is mishandled during extractPDFSubtype processing. (CVE-2018-20662)

  - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function     PSOutputDev::checkPageSlice at PSOutputDev.cc. (CVE-2019-10871)

  - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function     Splash::blitTransparent at splash/Splash.cc. (CVE-2019-10872)

  - An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function     SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. (CVE-2019-14494)

  - In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry     function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly     have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. (CVE-2019-7310)

  - A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0     that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an     attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
    (CVE-2019-9200)

  - Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter     function. (CVE-2019-9631)

  - PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in     the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted     pdf file to the pdfunite binary. (CVE-2019-9903)

  - The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream     length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the     heap, with a size controlled by an attacker, as demonstrated by pdftocairo. (CVE-2019-9959)

  - A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could     exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would     crash the application causing a denial of service. (CVE-2020-27778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Poppler 0.68.0, the Parser::getObj() function in     Parser.cc may cause infinite recursion via a crafted     file. A remote attacker can leverage this for a DoS     attack.(CVE-2018-16646)

  - An issue was discovered in Poppler 0.71.0. There is a     memory leak in GfxColorSpace::setDisplayProfile in     GfxState.cc, as demonstrated by     pdftocairo.(CVE-2018-18897)

  - An issue was discovered in Poppler 0.71.0. There is a     reachable abort in Object.h, will lead to denial of     service because EmbFile::save2 in FileSpec.cc lacks a     stream check before saving an embedded     file.(CVE-2018-19058)

  - An issue was discovered in Poppler 0.71.0. There is a     out-of-bounds read in EmbFile::save2 in FileSpec.cc,     will lead to denial of service, as demonstrated by     utils/pdfdetach.cc not validating embedded files before     save attempts.(CVE-2018-19059)

  - An issue was discovered in Poppler 0.71.0. There is a     NULL pointer dereference in goo/GooString.h, will lead     to denial of service, as demonstrated by     utils/pdfdetach.cc not validating a filename of an     embedded file before constructing a save     path.(CVE-2018-19060)

  - Poppler before 0.70.0 has a NULL pointer dereference in
    _poppler_attachment_new when called from     poppler_annot_file_attachment_get_attachment.(CVE-2018-     19149)

  - A reachable Object::dictLookup assertion in Poppler     0.72.0 allows attackers to cause a denial of service     due to the lack of a check for the dict data type, as     demonstrated by use of the FileSpec class (in     FileSpec.cc) in pdfdetach.(CVE-2018-20650)

  - In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows     attackers to cause a denial-of-service (application     crash caused by Object.h SIGABRT, because of a wrong     return value from PDFDoc::setup) by crafting a PDF file     in which an xref data structure is mishandled during     extractPDFSubtype processing.(CVE-2018-20662)

  - Poppler 0.74.0 has a heap-based buffer over-read in the     CairoRescaleBox.cc downsample_row_box_filter     function.(CVE-2019-9631)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2022 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince or     Okular.

    Security Fix(es):

    * poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc (CVE-2019-7310)

    * poppler: heap-based buffer overflow in function ImageStream::getLine() in Stream.cc (CVE-2019-9200)

    * poppler: infinite recursion in Parser::getObj function in Parser.cc (CVE-2018-16646)

    * poppler: memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc (CVE-2018-18897)

    * poppler: reachable abort in Object.h (CVE-2018-19058)

    * poppler: out-of-bounds read in EmbFile::save2 in FileSpec.cc (CVE-2018-19059)

    * poppler: pdfdetach utility does not validate save paths (CVE-2018-19060)

    * poppler: NULL pointer dereference in _poppler_attachment_new (CVE-2018-19149)

    * poppler: NULL pointer dereference in the XRef::getEntry in XRef.cc (CVE-2018-20481)

    * poppler: reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc (CVE-2018-20650)

    * poppler: SIGABRT PDFDoc::setup class in PDFDoc.cc (CVE-2018-20662)

    * poppler: heap-based buffer over-read in function downsample_row_box_filter in CairoRescaleBox.cc     (CVE-2019-9631)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
128294	Amazon Linux AMI : poppler (ALAS-2019-1271)	Nessus	Amazon Linux Local Security Checks	8/28/2019	5/1/2024	critical
155796	SUSE SLED15 / SLES15 Security Update : poppler (SUSE-SU-2021:3854-1)	Nessus	SuSE Local Security Checks	12/2/2021	7/13/2023	critical
120434	Fedora 28：poppler（2018-54ed26a423）	Nessus	Fedora Local Security Checks	1/3/2019	7/5/2024	medium
120870	Fedora 29：poppler（2018-e805688895）	Nessus	Fedora Local Security Checks	1/3/2019	6/28/2024	medium
142619	Debian DLA-2440-1: popplerセキュリティ更新	Nessus	Debian Local Security Checks	11/9/2020	2/9/2024	high
155770	openSUSE 15 セキュリティ更新: poppler（openSUSE-SU-2021:3854-1）	Nessus	SuSE Local Security Checks	12/2/2021	9/19/2022	critical
127648	RHEL 7：poppler（RHSA-2019:2022）	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	critical
153304	EulerOS 2.0 SP2 : poppler (EulerOS-SA-2021-2425)	Nessus	Huawei Local Security Checks	9/14/2021	11/30/2023	medium
120434	Fedora 28 : poppler (2018-54ed26a423)	Nessus	Fedora Local Security Checks	1/3/2019	7/5/2024	medium
120870	Fedora 29 : poppler (2018-e805688895)	Nessus	Fedora Local Security Checks	1/3/2019	6/28/2024	medium
142619	Debian DLA-2440-1 : poppler security update	Nessus	Debian Local Security Checks	11/9/2020	2/9/2024	high
155770	openSUSE 15 Security Update : poppler (openSUSE-SU-2021:3854-1)	Nessus	SuSE Local Security Checks	12/2/2021	9/19/2022	critical
130731	EulerOS 2.0 SP3 : poppler (EulerOS-SA-2019-2269)	Nessus	Huawei Local Security Checks	11/8/2019	4/12/2024	critical
127648	RHEL 7 : poppler (RHSA-2019:2022)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	critical

Detections

Analytics

Plugins Search

critical

critical

medium

medium

high

critical

critical

medium

medium

medium

high

critical

critical

critical