Advisories ยป MGASA-2017-0378

Updated poppler packages fix security vulnerabilities

Publication date: 19 Oct 2017
Modification date: 19 Oct 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-14518 , CVE-2017-14617 , CVE-2017-14926 , CVE-2017-14928 , CVE-2017-14929 , CVE-2017-14975 , CVE-2017-14977

Description

In Poppler 0.59.0, a floating point exception exists in the
isImageInterpolationRequired() function in Splash.cc via a crafted PDF
document. (CVE-2017-14518)

In Poppler 0.59.0, a floating point exception occurs in the ImageStream
class in Stream.cc, which may lead to a potential attack when handling
malicious PDF files. (CVE-2017-14617)

In Poppler 0.59.0, a NULL Pointer Dereference exists in
AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.
(CVE-2017-14926)

In Poppler 0.59.0, a NULL Pointer Dereference exists in
AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted
PDF document. (CVE-2017-14928)

In Poppler 0.59.0, memory corruption occurs in a call to
Object::dictLookup() in Object.h after a repeating series of
Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill,
Gfx::doTilingPatternFill and Gfx::drawForm calls (aka a Gfx.cc infinite
loop), a different vulnerability than CVE-2017-14519. (CVE-2017-14929)

The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler
0.59.0 has a NULL pointer dereference vulnerability because a data
structure is not initialized, which allows an attacker to launch a
denial of service attack. (CVE-2017-14975)

The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler
0.59.0 has a NULL pointer dereference vulnerability due to lack of
validation of a table pointer, which allows an attacker to launch a
denial of service attack. (CVE-2017-14977)

References

SRPMS

5/core

6/core