poppler - Denial-of-Service and Memory Corruption Vulnerabilities
Summary
DLA-1116-1: poppler - security update. Affects poppler versions < 0.18.4-6+deb7u3. Fixed in 0.18.4-6+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is a PDF rendering library used for rendering PDF files. It provides various functionalities for parsing and rendering PDF documents. The library is widely used in applications that require PDF rendering capabilities. However, several vulnerabilities have been discovered in poppler that could lead to denial-of-service (application crash), null pointer dereferences, and memory corruption.
Vulnerability Detail
The vulnerabilities in poppler include:
-
CVE-2017-14517: This vulnerability involves a NULL pointer dereference in the XRef::parseEntry() function in XRef.cc. An attacker could exploit this vulnerability to cause a denial-of-service condition.
-
CVE-2017-14519: This vulnerability results in memory corruption in a call to Object::streamGetChar, which may lead to a denial-of-service or other unspecified impact.
-
CVE-2017-14617: This vulnerability is a potential buffer overflow in the ImageStream class in Stream.cc. It could result in a denial-of-service or other unspecified impact.
How To Fix
Minimum fixed version
0.18.4-6+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade popplerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Poppler, a PDF rendering library, is affected by denial-of-service and memory corruption vulnerabilities. It is crucial to upgrade the poppler package to the recommended version to mitigate these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for poppler →
FAQ
Poppler is a PDF rendering library used for rendering PDF files in various applications.
The vulnerabilities in poppler include denial-of-service (application crash), null pointer dereferences, and memory corruption issues.
The impact of these vulnerabilities can range from denial-of-service conditions to potential memory corruption, which may lead to further exploitation.
To fix these vulnerabilities, it is recommended to upgrade the poppler package to version 0.18.4-6+deb7u3 or later.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
