[SECURITY] [DLA 1116-1] poppler security update

2017-09-2720:57:03

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

25.2%

JSON

Package : poppler
Version : 0.18.4-6+deb7u3
CVE ID : CVE-2017-14517 CVE-2017-14519 CVE-2017-14617
Debian Bug : 876086 876385 876079

It was discovered that poppler, a PDF rendering library, was affected
by several denial-of-service (application crash), null pointer
dereferences and memory corruption bugs:

CVE-2017-14517
NULL Pointer Dereference in the XRef::parseEntry() function in
XRef.cc

CVE-2017-14519
Memory corruption occurs in a call to Object::streamGetChar that
may lead to a denial of service or other unspecified impact.

CVE-2017-14617
Potential buffer overflow in the ImageStream class in Stream.cc,
which may lead to a denial of service or other unspecified impact.

For Debian 7 "Wheezy", these problems have been fixed in version
0.18.4-6+deb7u3.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7allpoppler< 0.18.4-6+deb7u3poppler_0.18.4-6+deb7u3_all.deb
Debian7armelpoppler-dbg< 0.18.4-6+deb7u3poppler-dbg_0.18.4-6+deb7u3_armel.deb
Debian7i386libpoppler-qt4-3< 0.18.4-6+deb7u3libpoppler-qt4-3_0.18.4-6+deb7u3_i386.deb
Debian7i386poppler-dbg< 0.18.4-6+deb7u3poppler-dbg_0.18.4-6+deb7u3_i386.deb
Debian7armellibpoppler-glib-dev< 0.18.4-6+deb7u3libpoppler-glib-dev_0.18.4-6+deb7u3_armel.deb
Debian7amd64libpoppler19< 0.18.4-6+deb7u3libpoppler19_0.18.4-6+deb7u3_amd64.deb
Debian7armellibpoppler-private-dev< 0.18.4-6+deb7u3libpoppler-private-dev_0.18.4-6+deb7u3_armel.deb
Debian7armelpoppler-utils< 0.18.4-6+deb7u3poppler-utils_0.18.4-6+deb7u3_armel.deb
Debian7armhflibpoppler-private-dev< 0.18.4-6+deb7u3libpoppler-private-dev_0.18.4-6+deb7u3_armhf.deb
Debian7i386libpoppler19< 0.18.4-6+deb7u3libpoppler19_0.18.4-6+deb7u3_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	poppler	< 0.18.4-6+deb7u3	poppler_0.18.4-6+deb7u3_all.deb
Debian	7	armel	poppler-dbg	< 0.18.4-6+deb7u3	poppler-dbg_0.18.4-6+deb7u3_armel.deb
Debian	7	i386	libpoppler-qt4-3	< 0.18.4-6+deb7u3	libpoppler-qt4-3_0.18.4-6+deb7u3_i386.deb
Debian	7	i386	poppler-dbg	< 0.18.4-6+deb7u3	poppler-dbg_0.18.4-6+deb7u3_i386.deb
Debian	7	armel	libpoppler-glib-dev	< 0.18.4-6+deb7u3	libpoppler-glib-dev_0.18.4-6+deb7u3_armel.deb
Debian	7	amd64	libpoppler19	< 0.18.4-6+deb7u3	libpoppler19_0.18.4-6+deb7u3_amd64.deb
Debian	7	armel	libpoppler-private-dev	< 0.18.4-6+deb7u3	libpoppler-private-dev_0.18.4-6+deb7u3_armel.deb
Debian	7	armel	poppler-utils	< 0.18.4-6+deb7u3	poppler-utils_0.18.4-6+deb7u3_armel.deb
Debian	7	armhf	libpoppler-private-dev	< 0.18.4-6+deb7u3	libpoppler-private-dev_0.18.4-6+deb7u3_armhf.deb
Debian	7	i386	libpoppler19	< 0.18.4-6+deb7u3	libpoppler19_0.18.4-6+deb7u3_i386.deb