CVE-2024-6239: Denial of Service in Poppler's Pdfinfo Utility
Summary
CVE-2024-6239: A flaw was found in the Poppler's Pdfinfo utility. Affects poppler across 2 version ranges.
< 24.02.0-r2
< 64828896a3bff4adafd2f3cac766165bb09a32a1
Fixed in 24.02.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is an open-source software library for rendering PDF documents. It is used by various applications to handle PDF files. The Pdfinfo utility is a command-line tool provided by Poppler that extracts information from PDF files. It is commonly used to retrieve metadata, page count, and other details from PDF documents.
Vulnerability Detail
The vulnerability (CVE-2024-6239) occurs when using the -dests parameter with the Pdfinfo utility. By providing certain malformed input files, an attacker can trigger a crash in the utility, leading to a denial of service. This vulnerability does not allow for remote code execution or unauthorized access to sensitive information. However, it can disrupt the availability of the Pdfinfo utility and potentially impact workflows that rely on it.
How To Fix
Minimum fixed version
24.02.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade popplerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to apply the official patch or update the package to a fixed version as soon as possible.
Conclusion
The vulnerability (CVE-2024-6239) in Poppler's Pdfinfo utility can be exploited to cause a denial of service. It is recommended to update the affected package to a patched version or apply the official fix provided by the Poppler project. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for poppler →
FAQ
Poppler is an open-source software library for rendering PDF documents. It provides various utilities and APIs for working with PDF files.
Pdfinfo is a command-line tool provided by Poppler that extracts information from PDF files. It is commonly used to retrieve metadata, page count, and other details from PDF documents.
CVE-2024-6239 is a vulnerability in Poppler's Pdfinfo utility that can be exploited to cause a denial of service by crashing the utility with specially crafted input files.
The vulnerability can lead to a denial of service, causing the Pdfinfo utility to crash. This can disrupt workflows that rely on Pdfinfo and impact the availability of information extracted from PDF files.
To fix this vulnerability, update the affected package to a version that includes the patch for CVE-2024-6239. Upgrade your Poppler installation to the latest patched version.
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
