[SECURITY] [DLA 1706-1] poppler security update

Package : poppler
Version : 0.26.5-2+deb8u8
CVE ID : CVE-2018-19058 CVE-2018-20481 CVE-2018-20662
CVE-2019-7310 CVE-2019-9200
Debian Bug : 913177 917325 918158 921215 923414

Several security vulnerabilities were discovered in the poppler PDF
rendering shared library.

CVE-2018-19058

A reachable abort in Object.h will lead to denial-of-service because
EmbFile::save2 in FileSpec.cc lacks a stream check before saving an
embedded file.

CVE-2018-20481

Poppler mishandles unallocated XRef entries, which allows remote
attackers to cause a denial-of-service (NULL pointer dereference)
via a crafted PDF document.

CVE-2018-20662

Poppler allows attackers to cause a denial-of-service (application
crash and segmentation fault by crafting a PDF file in which an xref
data structure is corrupted.

CVE-2019-7310

A heap-based buffer over-read (due to an integer signedness error in
the XRef::getEntry function in XRef.cc) allows remote attackers to
cause a denial of service (application crash) or possibly have
unspecified other impact via a crafted PDF document.

CVE-2019-9200

A heap-based buffer underwrite exists in ImageStream::getLine()
located at Stream.cc that can (for example) be triggered by sending
a crafted PDF file to the pdfimages binary. It allows an attacker to
cause denial-of-service (segmentation fault) or possibly have
unspecified other impact.

For Debian 8 "Jessie", these problems have been fixed in version
0.26.5-2+deb8u8.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS