Heap-based buffer overflow in Poppler - CVE-2019-9200

Vulnerability identifier: #VU19604

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9200

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files in ImageStream::getLine() function in Stream.cc. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Poppler
Amazon Linux AMI
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Workstation Extension
Fedora
libpoppler73
libpoppler73-debuginfo
poppler-debugsource
libpoppler-cpp0
libpoppler-cpp0-debuginfo
libpoppler-devel
libpoppler-glib-devel
libpoppler-glib8
libpoppler-glib8-debuginfo
poppler-tools
poppler-tools-debuginfo
typelib-1_0-Poppler-0_18
poppler

Install updates from vendor's website.

Poppler - update to 0.75.0
libpoppler73 - update to 0.62.0-4.6.1
libpoppler73-debuginfo - update to 0.62.0-4.6.1
poppler-debugsource - update to 0.62.0-4.6.1
libpoppler-cpp0 - update to 0.62.0-4.6.1
libpoppler-cpp0-debuginfo - update to 0.62.0-4.6.1
libpoppler-devel - update to 0.62.0-4.6.1
libpoppler-glib-devel - update to 0.62.0-4.6.1
libpoppler-glib8 - update to 0.62.0-4.6.1
libpoppler-glib8-debuginfo - update to 0.62.0-4.6.1
poppler-tools - update to 0.62.0-4.6.1
poppler-tools-debuginfo - update to 0.62.0-4.6.1
typelib-1_0-Poppler-0_18 - update to 0.62.0-4.6.1
poppler - addressed in versions 0.62.0-20.fc28, 0.67.0-16.fc29, 0.73.0-8.fc30

• https://gitlab.freedesktop.org/poppler/poppler/issues/728
• https://research.loginsoft.com/bugs/heap-based-buffer-underwrite-in-imagestreamgetline-poppler-0-74-0/

• Multiple vulnerabilities in Poppler
• Red Hat update for poppler
• Amazon Linux AMI update for poppler
• Red Hat update for poppler
• SUSE update for poppler
• Fedora 29 update for poppler
• Fedora 28 update for poppler
• Fedora 30 update for poppler