Red Hat Security Advisory: poppler security, bug fix, and enhancement update

Fixed packages 80

Vulnerabilities 12

• Unscored —
  CVE-2018-16646

  In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote…

  poppler poppler Debian Ubuntu
  Sep 6, 2018
• Unscored —
  CVE-2018-18897

  An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, a…

  poppler poppler Debian Ubuntu
  Nov 2, 2018
• Unscored —
  CVE-2018-19058

  An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service becau…

  poppler poppler Debian Ubuntu
  Nov 7, 2018
• Unscored —
  CVE-2018-19059

  An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to…

  poppler poppler Debian Ubuntu
  Nov 7, 2018
• Unscored —
  CVE-2018-19060

  An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial …

  poppler poppler Debian Ubuntu
  Nov 7, 2018
• Unscored —
  CVE-2018-19149

  Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_att…

  poppler poppler Debian Ubuntu
  Nov 10, 2018
• Unscored —
  CVE-2018-20481

  XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause…

  poppler poppler Debian Ubuntu
  Dec 26, 2018
• Unscored —
  CVE-2018-20650

  A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lac…

  poppler poppler Debian Ubuntu
  Jan 1, 2019
• Unscored —
  CVE-2018-20662

  In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused b…

  poppler poppler Debian Ubuntu
  Jan 3, 2019
• Unscored —
  CVE-2019-7310

  In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in …

  poppler poppler Debian Ubuntu
  Feb 3, 2019
• Unscored —
  CVE-2019-9200

  A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for ex…

  poppler poppler Debian Ubuntu
  Feb 26, 2019
• Unscored —
  CVE-2019-9631

  Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

  poppler poppler Debian Ubuntu
  Mar 8, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1378075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1378961
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1458037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1541358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1626618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1639595
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1646546
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649450
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1658304
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1665263
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1665266
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1665273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1672419
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1683632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1686802
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2022.json
• report
  https://access.redhat.com/security/cve/CVE-2018-16646
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16646
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16646
• report
  https://access.redhat.com/security/cve/CVE-2018-18897
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-18897
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-18897
• report
  https://access.redhat.com/security/cve/CVE-2018-19058
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-19058
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-19058
• report
  https://access.redhat.com/security/cve/CVE-2018-19059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-19059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-19059
• report
  https://access.redhat.com/security/cve/CVE-2018-19060
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-19060
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-19060
• report
  https://access.redhat.com/security/cve/CVE-2018-19149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-19149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-19149