Out-of-bounds read in Poppler - CVE-2019-12293

Vulnerability identifier: #VU19596

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12293

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in JPXStream::init() function in JPEG2000Stream.cc via data with inconsistent heights or widths. A remote attacker can perform a denial of service attack.

Poppler
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
openSUSE Leap
openEuler
Fedora
poppler (Red Hat package)
libpoppler-qt4-4
libpoppler-qt4-4-debuginfo
libpoppler60-debuginfo
poppler-tools-debuginfo
libpoppler60
libpoppler-glib8-debuginfo
libpoppler-glib8
poppler-tools
libpoppler-cpp0-debuginfo
libpoppler-cpp0
libpoppler-devel
libpoppler-glib-devel
typelib-1_0-Poppler-0_18
libpoppler-qt4-devel
poppler-debugsource
libpoppler73
libpoppler73-debuginfo
libpoppler73-32bit
libpoppler73-32bit-debuginfo
poppler-glib-doc
poppler-glib-devel
poppler-help
poppler-cpp
poppler-qt-devel
poppler-debuginfo
poppler-glib
poppler-devel
poppler-cpp-devel
poppler-qt5-devel
poppler-qt
poppler-qt5
poppler
evince (Red Hat package)

Install update from vendor's website.

Poppler - update to 0.77.0
poppler (Red Hat package) - update to 0.26.5-42.el7
libpoppler-qt4-4 - update to 0.43.0-16.25.1
libpoppler-qt4-4-debuginfo - update to 0.43.0-16.25.1
libpoppler60-debuginfo - update to 0.43.0-16.25.1
poppler-tools-debuginfo - update to 0.43.0-16.25.1
libpoppler60 - update to 0.43.0-16.25.1
libpoppler-glib8-debuginfo - update to 0.43.0-16.25.1
libpoppler-glib8 - update to 0.43.0-16.25.1
poppler-tools - update to 0.43.0-16.25.1
libpoppler-cpp0-debuginfo - update to 0.43.0-16.25.1
libpoppler-cpp0 - update to 0.43.0-16.25.1
libpoppler-devel - update to 0.43.0-16.25.1
libpoppler-glib-devel - update to 0.43.0-16.25.1
typelib-1_0-Poppler-0_18 - update to 0.43.0-16.25.1
libpoppler-qt4-devel - update to 0.43.0-16.25.1
poppler-debugsource - update to 0.43.0-16.25.1
libpoppler73 - update to 0.62.0-150000.4.15.1
libpoppler73-debuginfo - update to 0.62.0-150000.4.15.1
libpoppler73-32bit - update to 0.62.0-150000.4.15.1
libpoppler73-32bit-debuginfo - update to 0.62.0-150000.4.15.1
poppler-glib-doc - update to 0.67.0-7
poppler-glib-devel - update to 0.67.0-7
poppler-help - update to 0.67.0-7
poppler-cpp - update to 0.67.0-7
poppler-qt-devel - update to 0.67.0-7
poppler-debuginfo - update to 0.67.0-7
poppler-glib - update to 0.67.0-7
poppler-devel - update to 0.67.0-7
poppler-cpp-devel - update to 0.67.0-7
poppler-qt5-devel - update to 0.67.0-7
poppler-debugsource - update to 0.67.0-7
poppler-qt - update to 0.67.0-7
poppler-qt5 - update to 0.67.0-7
poppler - update to 0.67.0-7
poppler - addressed in versions 0.67.0-21.fc29, 0.73.0-13.fc30
evince (Red Hat package) - update to 3.28.2-9.el7

• https://gitlab.freedesktop.org/poppler/poppler/issues/768
• https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html

• Denial of service in Poppler
• Red Hat update for poppler
• Amazon Linux AMI update for poppler
• Red Hat Enterprise Linux 7 update for poppler and evince
• SUSE update for poppler
• SUSE update for poppler
• openEuler update for poppler
• Fedora 29 update for poppler
• Fedora 30 update for poppler