Medium WID-SEC-2023-3200 7 CVEs

poppler: Mehrere Schwachstellen

Published Jul 10, 2017 · Updated Dec 21, 2023 · Revision 7 · de-DE

Vendor: Debian Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 14.04 LTS Product: Linux 16.04 LTS Product: Linux 16.10 Product: Linux 17.04 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in poppler ausnutzen, um einen Denial of Service Angriff durchzuführen oder beliebigen Programmcode ausführen zu lassen.

Product

Mit poppler können PDF-Dokumente unter Unix-ähnlichen Betriebssysteme betrachtet werden.

Vulnerabilities 7

High 8.8

CVE-2017-2820

An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Po…

Poppler poppler poppler poppler Debian Ubuntu

Jul 12, 2017
Unscored —

CVE-2017-7511

poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted…

Poppler poppler poppler poppler Debian Ubuntu

May 30, 2017
Unscored —

CVE-2017-7515

poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-o…

Red Hat poppler poppler poppler Debian Ubuntu

Jun 6, 2017
Unscored —

CVE-2017-9083

poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte functi…

poppler poppler Debian Ubuntu

May 19, 2017
Unscored —

CVE-2017-9406

In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to …

poppler poppler Debian Ubuntu

Jun 2, 2017
Unscored —

CVE-2017-9408

In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows a…

poppler poppler Debian Ubuntu

Jun 2, 2017
Unscored —

CVE-2017-9775

Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of …

poppler poppler Debian Ubuntu

Jun 22, 2017

Revision history

2023-12-21 #7
Neue Updates von SUSE aufgenommen
2018-01-17 #6
New remediations available
2018-01-07 #5
New remediations available
2017-08-30 #4
New remediations available
2017-07-30 #3
New remediations available
2017-07-10 #1
Initial Release
2017-07-10 #2
Version nicht vorhanden

References

Ubuntu Security Notice USN-3350-1 vom 2017-07-10
http://www.ubuntu.com/usn/usn-3350-1/
SUSE Security Update SUSE-SU-2017:1998-1 vom 2017-07-29
https://www.suse.com/support/update/announcement/2017/suse-su-20171998-1.html
SUSE Security Update SUSE-SU-2017:1999-1 vom 2017-07-29
https://www.suse.com/support/update/announcement/2017/suse-su-20171999-1.html
Red Hat Security Advisory RHSA-2017:2551 vom 2017-08-31
https://access.redhat.com/errata/RHSA-2017:2551
Oracle Linux Security Advisory ELSA-2017-2551 vom 2017-08-31
http://linux.oracle.com/errata/ELSA-2017-2551.html
Debian Security Advisory DSA-4079 vom 2018-01-08
https://www.debian.org/security/2018/dsa-4079
GENTOO Security Advisory GLSA201801-17 vom 2018-01-17
https://security.gentoo.org/glsa/201801-17
SUSE Security Update SUSE-SU-2023:4941-1 vom 2023-12-21
https://lists.suse.com/pipermail/sle-security-updates/2023-December/017519.html