PT-2019-2633 · Poppler+1 · Poppler+1

Published 2019-04-05 · Updated 2019-09-06 · CVE-2019-10873

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Poppler version 0.74.0

Description The issue is related to a NULL pointer dereference in the SplashClip::clipAALine function at splash/SplashClip.cc. This could allow a remote attacker to cause a denial of service using a specially crafted PDF document.

Recommendations For Poppler version 0.74.0, consider disabling the SplashClip::clipAALine function as a temporary workaround until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2019-02518

CVE-2019-10873

MGASA-2019-0245

USN-4042-1

Affected Products

Poppler

Ubuntu

References · 61

• 🔥 https://gitlab.freedesktop.org/poppler/poppler/issues/748 · Exploit
• https://ubuntu.com/security/CVE-2018-18897 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20662 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9903 · Security Note
• https://ubuntu.com/security/CVE-2019-10018 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10873 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0245 · Vendor Advisory
• https://usn.ubuntu.com/4042-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0245.html · Security Note
• https://bdu.fstec.ru/vul/2021-03434 · Security Note
• https://bdu.fstec.ru/vul/2022-06890 · Security Note
• https://bdu.fstec.ru/vul/2021-01304 · Security Note
• https://ubuntu.com/security/CVE-2018-20662 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9631 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01318 · Security Note