PT-2015-7823 · Poppler+4 · Poppler+4
Nafiez
·
Publicado
2015-12-31
·
Atualizado
2018-01-05
·
CVE-2015-8868
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Poppler versions prior to 0.40.0
Description
The issue is related to a heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function. This can be triggered by remote attackers via an invalid blend mode in the ExtGState dictionary in a crafted PDF document, potentially leading to a denial of service (memory corruption and crash) or possibly the execution of arbitrary code.
Recommendations
For versions prior to 0.40.0, update to version 0.40.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of PDF documents from untrusted sources until the update is applied.
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Poppler
Red Hat
Suse
Ubuntu