Integer overflow in Poppler - CVE-2019-9959

Vulnerability identifier: #VU19570

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9959

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in the "JPXStream::init" function, caused by a failure to bounds-check user-supplied data before copying it to an undersized memory buffer. A remote attacker can supply crafted data to the system, trigger integer overflow and cause a denial of service condition on the targeted system.

Poppler
Amazon Linux AMI
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Workstation Extension
Ubuntu
Fedora
poppler (Alpine package)
poppler (Red Hat package)
libpoppler58 (Ubuntu package)
poppler-utils (Ubuntu package)
libpoppler73 (Ubuntu package)
libpoppler-glib-devel
typelib-1_0-Poppler-0_18
poppler-tools-debuginfo
poppler-tools
libpoppler-glib8-debuginfo
libpoppler-glib8
libpoppler-devel
libpoppler-cpp0-debuginfo
libpoppler-cpp0
poppler-debugsource
libpoppler73-debuginfo
libpoppler73
poppler
evince (Red Hat package)

Install updates from vendor's website.

Poppler - update to 0.79.0
poppler (Alpine package) - addressed in versions 0.56.0-r1, 0.56.0-r2
poppler (Red Hat package) - update to 0.26.5-42.el7
libpoppler58 (Ubuntu package) - update to 0.41.0-0ubuntu1.15
poppler-utils (Ubuntu package) - addressed in versions 0.41.0-0ubuntu1.15, 0.62.0-2ubuntu2.11
libpoppler73 (Ubuntu package) - update to 0.62.0-2ubuntu2.11
libpoppler-glib-devel - update to 0.62.0-4.6.1
typelib-1_0-Poppler-0_18 - update to 0.62.0-4.6.1
poppler-tools-debuginfo - update to 0.62.0-4.6.1
poppler-tools - update to 0.62.0-4.6.1
libpoppler-glib8-debuginfo - update to 0.62.0-4.6.1
libpoppler-glib8 - update to 0.62.0-4.6.1
libpoppler-devel - update to 0.62.0-4.6.1
libpoppler-cpp0-debuginfo - update to 0.62.0-4.6.1
libpoppler-cpp0 - update to 0.62.0-4.6.1
poppler-debugsource - update to 0.62.0-4.6.1
libpoppler73-debuginfo - update to 0.62.0-4.6.1
libpoppler73 - update to 0.62.0-4.6.1
poppler - addressed in versions 0.67.0-22.fc29, 0.73.0-14.fc30
evince (Red Hat package) - update to 3.28.2-9.el7

• https://gitlab.freedesktop.org/poppler/poppler/blob/master/NEWS

• Multiple vulnerabilities in Poppler
• Red Hat update for poppler
• Amazon Linux AMI update for poppler
• Integer overflow in poppler (Alpine package)
• Red Hat Enterprise Linux 7 update for poppler and evince
• SUSE update for poppler
• Ubuntu update for poppler
• Fedora 29 update for poppler
• Fedora 30 update for poppler