PT-2015-7823 · Poppler+4 · Poppler+4

Nafiez · Published 2015-12-31 · Updated 2018-01-05 · CVE-2015-8868

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Poppler versions prior to 0.40.0

Description The issue is related to a heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function. This can be triggered by remote attackers via an invalid blend mode in the ExtGState dictionary in a crafted PDF document, potentially leading to a denial of service (memory corruption and crash) or possibly the execution of arbitrary code.

Recommendations For versions prior to 0.40.0, update to version 0.40.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of PDF documents from untrusted sources until the update is applied.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2016_2580

CVE-2015-8868

DLA-446-1

DSA-3563-1

RHSA-2016:2580

RHSA-2016_2580

SUSE-SU-2016:1543-1

SUSE-SU-2016:1544-1

SUSE-SU-2016_1543-1

SUSE-SU-2016_1544-1

USN-2958-1

Affected Products

Centos

Poppler

Red Hat

Suse

Ubuntu

References · 52

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4473 · Security Note
• https://ubuntu.com/security/CVE-2013-4473 · Vendor Advisory
• http://debian.org/security/2016/dsa-3563 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/poppler · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2580.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1543-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183142.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4474 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8868 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8868 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4474 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-8868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8868 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8868 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3563-1 · Vendor Advisory