Description
PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Attackers can trigger a segmentation fault in the XRef::getEntry function within libpoppler by providing a specially crafted PDF file to the pdfunite utility.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| poppler-utils | PDFunite | 0.41.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 18.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 16.04 LTS | poppler | No fix yet | — |
References
- ExploitDB-44490 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: PDFunite 0.41.0 Buffer Overflow via Malformed PDF third-party-advisory