The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

This update fixes an code execution bug. (CVE-2008-2950)

A memory management issue was found in libpoppler by Felipe Andres Manzano that could allow for the execution of arbitrary code with the privileges of the user running a poppler-based application, if they opened a specially crafted PDF file (CVE-2008-2950).

The updated packages have been patched to correct this issue.

Security fix: Add upstream patch for CVE-2008-2950 / oCERT-2008-007 - use of an uninitialized pointer to call free() in Page::~Page (#454277) http://www.ocert.org/advisories/ocert-2008-007.html Bug fixes: Fix crash when reading QuadPoints (#448516) Use static FT_Library in CairoOutputDev, as dynamic may trigger use-after-free and crash e.g. evince (#456867)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix: Add upstream patch for CVE-2008-2950 / oCERT-2008-007 - use of an uninitialized pointer to call free() in Page::~Page (#454277) http://www.ocert.org/advisories/ocert-2008-007.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Felipe Andres Manzano discovered that poppler did not correctly initialize certain page widgets. If a user were tricked into viewing a malicious PDF file, a remote attacker could exploit this to crash applications linked against poppler, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Felipe Andres Manzano reports :

The libpoppler pdf rendering library, can free uninitialized pointers, leading to arbitrary code execution. This vulnerability results from memory management bugs in the Page class constructor/destructor.

The remote host is affected by the vulnerability described in GLSA-200807-04 (Poppler: User-assisted execution of arbitrary code)

    Felipe Andres Manzano reported a memory management issue in the Page     class constructor/destructor.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF     file with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview,     or Evince, potentially resulting in the execution of arbitrary code     with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
40041	openSUSE Security Update : libpoppler-devel (libpoppler-devel-77)	Nessus	SuSE Local Security Checks	high
36531	Mandriva Linux Security Advisory : poppler (MDVSA-2008:146)	Nessus	Mandriva Local Security Checks	high
34172	Fedora 9 : poppler-0.8.1-2.fc9 (2008-7012)	Nessus	Fedora Local Security Checks	high
33847	Fedora 8 : poppler-0.6.2-2.fc8 (2008-7104)	Nessus	Fedora Local Security Checks	high
33760	Ubuntu 7.10 / 8.04 LTS : poppler vulnerability (USN-631-1)	Nessus	Ubuntu Local Security Checks	high
33471	FreeBSD : poppler -- uninitialized pointer (bc20510f-4dd4-11dd-93e7-0211d880e350)	Nessus	FreeBSD Local Security Checks	high
33461	GLSA-200807-04 : Poppler: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2008-2950

high

Tenable Plugins

high

high

high

high

high

high

high