SB2023122128 - SUSE update for poppler

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023122128

SB2023122128 - SUSE update for poppler

Published: December 21, 2023

Security Bulletin ID SB2023122128
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Null pointer dereference (CVE-ID: CVE-2017-7511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to NULL pointer dereference in the pdfunite when handling malicious content. A remote attacker can send specially crafted PDF file, trick the victim into opening it and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

2) Input validation error (CVE-ID: CVE-2018-20662)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a wrong return value from PDFDoc::setup when an xref data structure is mishandled during extractPDFSubtype processing. A remote attacker can trick the victim into opening a specially crafter PDF file cause application crash by Object.h SIGABRT.


Remediation

Install update from vendor's website.

References