Memory corruption in Poppler - CVE-2017-1000456
Published: January 29, 2018
Vulnerability identifier: #VU10326
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-1000456
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to improper validation of boundaries in TextPool::addWord in freedesktop.org libpoppler. A remote attacker can trigger overflow in subsequent calculations and cause the service to crash.
The weakness exists due to improper validation of boundaries in TextPool::addWord in freedesktop.org libpoppler. A remote attacker can trigger overflow in subsequent calculations and cause the service to crash.
Affected software
Poppler
Debian Linux
Gentoo Linux
Ubuntu
Fedora
openSUSE Leap
poppler
Debian Linux
Gentoo Linux
Ubuntu
Fedora
openSUSE Leap
poppler
How to mitigate CVE-2017-1000456
Install update from vendor's website.
poppler - addressed in versions 0.52.0-11.fc26, 0.57.0-7.fc27