Null pointer dereference in Poppler - CVE-2017-7511

Vulnerability identifier: #VU7488

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7511

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to NULL pointer dereference in the pdfunite when handling malicious content. A remote attacker can send specially crafted PDF file, trick the victim into opening it and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Poppler
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
Ubuntu
Fedora
libpoppler44-debuginfo
libpoppler44
mingw-poppler
poppler

Update to the latest version.

libpoppler44-debuginfo - update to 0.24.4-14.44.1
libpoppler44 - update to 0.24.4-14.44.1
mingw-poppler - addressed in versions 0.41.0-2.fc24, 0.45.0-2.fc25, 0.52.0-2.fc26
poppler - addressed in versions 0.41.0-4.fc24, 0.45.0-3.fc25, 0.52.0-2.fc26

• https://cgit.freedesktop.org/poppler/poppler/commit/?id=5c9b08a875b07853be6c44e43ff5f7f059df666a

• Ubuntu update for poppler
• Gentoo update for Poppler
• SUSE update for poppler
• Fedora 25 update for poppler
• Fedora 26 update for poppler
• Fedora 24 update for poppler
• Fedora 25 update for mingw-poppler
• Fedora 26 update for mingw-poppler
• Fedora 24 update for mingw-poppler