PT-2019-5324 · Poppler+6 · Poppler+6

Albert Astals Cid · Published 2019-07-11 · Updated 2023-01-19 · CVE-2019-14494

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Poppler versions through 0.78.0

Description The issue is related to a divide-by-zero error in the SplashOutputDev::tilingPatternFill function at SplashOutputDev.cc. This error can be exploited by a remote attacker to cause a denial of service.

Recommendations For Poppler versions through 0.78.0, as a temporary workaround, consider disabling the SplashOutputDev::tilingPatternFill function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

ALSA-2020:4643

AZL-44472

BDU:2020-02393

CESA-2020_3977

CESA-2020_4643

CVE-2019-14494

DLA-2440-1

DLA-3120-1

MGASA-2019-0244

MGASA-2019-0245

OPENSUSE-SU-2021:3854-1

OPENSUSE-SU-2021_3854-1

RHSA-2020:3977

RHSA-2020:4643

RHSA-2020_3977

RHSA-2020_4643

SUSE-SU-2021:3854-1

SUSE-SU-2022:1723-1

SUSE-SU-2022:1724-1

SUSE-SU-2022_1723-1

SUSE-SU-2022_1724-1

USN-4091-1

Affected Products

Almalinux

Astra Linux

Centos

Poppler

Red Hat

Suse

Ubuntu

References · 97

• 🔥 https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md · Exploit
• 🔥 https://gitlab.freedesktop.org/poppler/poppler/issues/802 · Exploit
• https://osv.dev/vulnerability/MGASA-2019-0245 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14494 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4091-1 · Vendor Advisory
• https://usn.ubuntu.com/4091-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0245.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14494 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0244 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AHYAM32PALHQXL3O4DKIJ3EJB6AKBOVC · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0244.html · Security Note
• https://osv.dev/vulnerability/AZL-44472 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3977.html · Vendor Advisory