Low: poppler

2020-11-1401:23:00

alas.aws.amazon.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.7%

JSON

Issue Overview:

A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by an application linked to Poppler, would crash the application causing a denial of service. (CVE-2019-14494)

Affected Packages:

poppler

Issue Correction:
Run yum update poppler to update your system.

New Packages:

i686:  
    poppler-0.26.5-43.22.amzn1.i686  
    poppler-utils-0.26.5-43.22.amzn1.i686  
    poppler-devel-0.26.5-43.22.amzn1.i686  
    poppler-glib-devel-0.26.5-43.22.amzn1.i686  
    poppler-cpp-0.26.5-43.22.amzn1.i686  
    poppler-debuginfo-0.26.5-43.22.amzn1.i686  
    poppler-glib-0.26.5-43.22.amzn1.i686  
    poppler-cpp-devel-0.26.5-43.22.amzn1.i686  
  
src:  
    poppler-0.26.5-43.22.amzn1.src  
  
x86_64:  
    poppler-0.26.5-43.22.amzn1.x86_64  
    poppler-glib-0.26.5-43.22.amzn1.x86_64  
    poppler-utils-0.26.5-43.22.amzn1.x86_64  
    poppler-glib-devel-0.26.5-43.22.amzn1.x86_64  
    poppler-cpp-0.26.5-43.22.amzn1.x86_64  
    poppler-debuginfo-0.26.5-43.22.amzn1.x86_64  
    poppler-devel-0.26.5-43.22.amzn1.x86_64  
    poppler-cpp-devel-0.26.5-43.22.amzn1.x86_64

Additional References

Red Hat: CVE-2019-14494

Mitre: CVE-2019-14494

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686poppler< 0.26.5-43.22.amzn1poppler-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-utils< 0.26.5-43.22.amzn1poppler-utils-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-devel< 0.26.5-43.22.amzn1poppler-devel-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-glib-devel< 0.26.5-43.22.amzn1poppler-glib-devel-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-cpp< 0.26.5-43.22.amzn1poppler-cpp-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-debuginfo< 0.26.5-43.22.amzn1poppler-debuginfo-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-glib< 0.26.5-43.22.amzn1poppler-glib-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1i686poppler-cpp-devel< 0.26.5-43.22.amzn1poppler-cpp-devel-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux1x86_64poppler< 0.26.5-43.22.amzn1poppler-0.26.5-43.22.amzn1.x86_64.rpm
Amazon Linux1x86_64poppler-glib< 0.26.5-43.22.amzn1poppler-glib-0.26.5-43.22.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	poppler	< 0.26.5-43.22.amzn1	poppler-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-utils	< 0.26.5-43.22.amzn1	poppler-utils-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-devel	< 0.26.5-43.22.amzn1	poppler-devel-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-glib-devel	< 0.26.5-43.22.amzn1	poppler-glib-devel-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-cpp	< 0.26.5-43.22.amzn1	poppler-cpp-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-debuginfo	< 0.26.5-43.22.amzn1	poppler-debuginfo-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-glib	< 0.26.5-43.22.amzn1	poppler-glib-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-cpp-devel	< 0.26.5-43.22.amzn1	poppler-cpp-devel-0.26.5-43.22.amzn1.i686.rpm
Amazon Linux	1	x86_64	poppler	< 0.26.5-43.22.amzn1	poppler-0.26.5-43.22.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	poppler-glib	< 0.26.5-43.22.amzn1	poppler-glib-0.26.5-43.22.amzn1.x86_64.rpm