Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14494: A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by an application linked to Poppler, would crash the application causing a denial of service. 1797453: CVE-2019-14494 poppler: divide-by-zero in function SplashOutputDev::tilingPatternFill in SplashOutputDev.cc
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | evince | 0:3.28.2-10.amzn2 |
| Amazon Linux · 2 | evince-browser-plugin | 0:3.28.2-10.amzn2 |
| Amazon Linux · 2 | evince-debuginfo | 0:3.28.2-10.amzn2 |
| Amazon Linux · 2 | evince-devel | 0:3.28.2-10.amzn2 |
| Amazon Linux · 2 | evince-dvi | 0:3.28.2-10.amzn2 |
| Amazon Linux · 2 | evince-libs | 0:3.28.2-10.amzn2 |
| Amazon Linux · 2 | evince-nautilus | 0:3.28.2-10.amzn2 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::til…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-14494.html