Debian Security Advisory

DLA-1706-1 poppler -- LTS security update

Date Reported:

08 Mar 2019

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 913177, Bug 917325, Bug 918158, Bug 921215, Bug 923414.
In Mitre's CVE dictionary: CVE-2018-19058, CVE-2018-20481, CVE-2018-20662, CVE-2019-7310, CVE-2019-9200.

More information:

Several security vulnerabilities were discovered in the poppler PDF rendering shared library.

CVE-2018-19058
A reachable abort in Object.h will lead to denial-of-service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
CVE-2018-20481
Poppler mishandles unallocated XRef entries, which allows remote attackers to cause a denial-of-service (NULL pointer dereference) via a crafted PDF document.
CVE-2018-20662
Poppler allows attackers to cause a denial-of-service (application crash and segmentation fault by crafting a PDF file in which an xref data structure is corrupted.
CVE-2019-7310
A heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
CVE-2019-9200
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause denial-of-service (segmentation fault) or possibly have unspecified other impact.

For Debian 8 Jessie, these problems have been fixed in version 0.26.5-2+deb8u8.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS