poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - poppler: heap buffer overflow in ExponentialFunction (CVE-2015-8868)

  - poppler: heap-based buffer over-read in function downsample_row_box_filter in CairoRescaleBox.cc     (CVE-2019-9631)

  - DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a     crafted PDF file. (CVE-2010-5110)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - poppler: recursive function call in JBIG2Stream::readGenericBitmap() in JBIG2Stream.cc causing denial of     service (CVE-2019-9543)

  - DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a     crafted PDF file. (CVE-2010-5110)

  - The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary     commands via a PDF containing an escape sequence for a terminal emulator. (CVE-2012-2142)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - The RenderV2ToFile function in tag_file.cpp in id3lib     (aka libid3) 3.8.3 allows local users to overwrite     arbitrary files via a symlink attack on a temporary file     whose name is constructed from the name of a file being     tagged. (CVE-2007-4460)

  - poppler before 0.22.1 allows context-dependent attackers     to cause a denial of service (crash) and possibly     execute arbitrary code via vectors that trigger an     'invalid memory access' in (1) splash/Splash.cc, (2)     poppler/Function.cc, and (3) poppler/Stream.cc.
    (CVE-2013-1788)

  - splash/Splash.cc in poppler before 0.22.1 allows     context-dependent attackers to cause a denial of service     (NULL pointer dereference and crash) via vectors related     to the (1) Splash::arbitraryTransformMask, (2)     Splash::blitMask, and (3) Splash::scaleMaskYuXu     functions. (CVE-2013-1789)

  - poppler/Stream.cc in poppler before 0.22.1 allows     context-dependent attackers to have an unspecified     impact via vectors that trigger a read of uninitialized     memory by the CCITTFaxStream::lookChar function.
    (CVE-2013-1790)

The remote host is affected by the vulnerability described in GLSA-201310-03 (Poppler: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Poppler. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF       file, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were discovered in the poppler PDF rendering library.

  - CVE-2013-1788     Multiple invalid memory access issues, which could     potentially lead to arbitrary code execution if the user     were tricked into opening a malformed PDF document.

  - CVE-2013-1790     An uninitialized memory issue, which could potentially     lead to arbitrary code execution if the user were     tricked into opening a malformed PDF document.

Multiple vulnerabilities has been found and corrected in poppler :

poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an invalid memory access in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc (CVE-2013-1788).

poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function (CVE-2013-1790).

The updated packages have been patched to correct these issues.

It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of poppler fixes the following vulnerabilities :

  - Various invalid memory issues could be used by attackers     supplying PDFs to crash the PDF viewer or potentially     execute code. (CVE-2013-1788)

  - A crash in poppler could be used by attackers providing     PDFs to crash the PDF viewer. (CVE-2013-1789)

  - An uninitialized memory read could be used by attackers     providing PDFs to crash the PDF viewer. (CVE-2013-1790)

This also fixes that transparent background in images are rendered black with evince. (bnc#745620).

This update of poppler fixes the following vulnerabilities :

  - Various invalid memory issues could be used by attackers     supplying PDFs to crash the PDF viewer or potentially     execute code. (CVE-2013-1788)

  - A crash in poppler could be used by attackers providing     PDFs to crash the PDF viewer. (CVE-2013-1789)

  - An uninitialized memory read could be used by attackers     providing PDFs to crash the PDF viewer. (CVE-2013-1790)

This update fixes these security issues: CVE-2013-1788, CVE-2013-1789 and CVE-2013-1790.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes these security issues: CVE-2013-1788 and CVE-2013-1790.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199549	RHEL 6 : poppler (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199510	RHEL 5 : poppler (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
80625	Oracle Solaris Third-Party Patch Update : gnome (cve_2007_4460_symlink_attack)	Nessus	Solaris Local Security Checks	high
70309	GLSA-201310-03 : Poppler: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
67236	Debian DSA-2719-1 : poppler - several vulnerabilities	Nessus	Debian Local Security Checks	medium
66155	Mandriva Linux Security Advisory : poppler (MDVSA-2013:143)	Nessus	Mandriva Local Security Checks	medium
65787	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : poppler vulnerabilities (USN-1785-1)	Nessus	Ubuntu Local Security Checks	medium
65785	SuSE 10 Security Update : poppler (ZYPP Patch Number 8523)	Nessus	SuSE Local Security Checks	medium
65784	SuSE 11.2 Security Update : poppler (SAT Patch Number 7560)	Nessus	SuSE Local Security Checks	medium
65538	Fedora 18 : poppler-0.20.2-10.fc18 (2013-3473)	Nessus	Fedora Local Security Checks	medium
65536	Fedora 17 : poppler-0.18.4-4.fc17 (2013-3457)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-1788

critical

Tenable Plugins

critical

high

high

high

medium

medium

medium

medium

medium

medium

medium