Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia: 2019-0244 Moderate: Poppler Buffer Over-Read and Related Issues

mageia
Calendar Grey September 6, 2019
Dist Mageia Esm H88
The recent security patch MGASA-2019-0244 for Poppler deals with several security flaws that impact users on Mageia 6.
Updated poppler packages fix security vulnerabilities Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function

Summary

Updated poppler packages fix security vulnerabilities
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. (CVE-2019-9631)
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary. (CVE-2019-9903)
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case. (CVE-2019-10018)
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps. (CVE-2019-10021)
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpMod case. (CVE-2019-10023)
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitT...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=25233

- https://access.redhat.com/errata/RHSA-2019:2022

- https://ubuntu.com/security/notices/USN-4042-1

- https://ubuntu.com/security/notices/USN-4091-1

- https://www.cve.org/CVERecord?id=CVE-2019-9631

- https://www.cve.org/CVERecord?id=CVE-2019-9903

- https://www.cve.org/CVERecord?id=CVE-2019-10018

- https://www.cve.org/CVERecord?id=CVE-2019-10021

- https://www.cve.org/CVERecord?id=CVE-2019-10023

- https://www.cve.org/CVERecord?id=CVE-2019-10872

- https://www.cve.org/CVERecord?id=CVE-2019-12293

- https://www.cve.org/CVERecord?id=CVE-2019-14494

Topics%20covered

Topics Covered

security advisory Xpdf poppler buffer over-read heap over-read Mageia stack consumption

Resolution

SRPMS

- 6/core/poppler-0.52.0-3.13.mga6

Publication date: 06 Sep 2019
URL: https://advisories.mageia.org/MGASA-2019-0244.html
Type: security
CVE: CVE-2019-9631, CVE-2019-9903, CVE-2019-10018, CVE-2019-10021, CVE-2019-10023, CVE-2019-10872, CVE-2019-12293, CVE-2019-14494

Topics%20covered

Topics Covered

security advisory Xpdf poppler buffer over-read heap over-read Mageia stack consumption

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here