[SECURITY] [DLA 1963-2] poppler regression update

2019-10-1806:44:30

lists.debian.org

176

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

80.7%

JSON

Package : poppler
Version : 0.18_0.26.5-2+deb8u13
CVE ID : CVE-2019-10871
Debian Bug : 942503

The fix for CVE-2019-10871 broke xpdf. This change has been reverted
until a better fix can be developed.

For Debian 8 "Jessie", this problem has been fixed in version
0.18_0.26.5-2+deb8u13.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8i386libpoppler-qt4-4< 0.26.5-2+deb8u13libpoppler-qt4-4_0.26.5-2+deb8u13_i386.deb
Debian8i386poppler-utils< 0.26.5-2+deb8u13poppler-utils_0.26.5-2+deb8u13_i386.deb
Debian8armelgir1.2-poppler-0.18< 0.26.5-2+deb8u13gir1.2-poppler-0.18_0.26.5-2+deb8u13_armel.deb
Debian8amd64libpoppler-private-dev< 0.26.5-2+deb8u13libpoppler-private-dev_0.26.5-2+deb8u13_amd64.deb
Debian8i386libpoppler-qt5-dev< 0.26.5-2+deb8u13libpoppler-qt5-dev_0.26.5-2+deb8u13_i386.deb
Debian8armhfpoppler-dbg< 0.26.5-2+deb8u13poppler-dbg_0.26.5-2+deb8u13_armhf.deb
Debian8armellibpoppler-qt4-dev< 0.26.5-2+deb8u13libpoppler-qt4-dev_0.26.5-2+deb8u13_armel.deb
Debian8armellibpoppler-dev< 0.26.5-2+deb8u13libpoppler-dev_0.26.5-2+deb8u13_armel.deb
Debian8armhflibpoppler-glib-dev< 0.26.5-2+deb8u13libpoppler-glib-dev_0.26.5-2+deb8u13_armhf.deb
Debian8armelpoppler-dbg< 0.26.5-2+deb8u13poppler-dbg_0.26.5-2+deb8u13_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	i386	libpoppler-qt4-4	< 0.26.5-2+deb8u13	libpoppler-qt4-4_0.26.5-2+deb8u13_i386.deb
Debian	8	i386	poppler-utils	< 0.26.5-2+deb8u13	poppler-utils_0.26.5-2+deb8u13_i386.deb
Debian	8	armel	gir1.2-poppler-0.18	< 0.26.5-2+deb8u13	gir1.2-poppler-0.18_0.26.5-2+deb8u13_armel.deb
Debian	8	amd64	libpoppler-private-dev	< 0.26.5-2+deb8u13	libpoppler-private-dev_0.26.5-2+deb8u13_amd64.deb
Debian	8	i386	libpoppler-qt5-dev	< 0.26.5-2+deb8u13	libpoppler-qt5-dev_0.26.5-2+deb8u13_i386.deb
Debian	8	armhf	poppler-dbg	< 0.26.5-2+deb8u13	poppler-dbg_0.26.5-2+deb8u13_armhf.deb
Debian	8	armel	libpoppler-qt4-dev	< 0.26.5-2+deb8u13	libpoppler-qt4-dev_0.26.5-2+deb8u13_armel.deb
Debian	8	armel	libpoppler-dev	< 0.26.5-2+deb8u13	libpoppler-dev_0.26.5-2+deb8u13_armel.deb
Debian	8	armhf	libpoppler-glib-dev	< 0.26.5-2+deb8u13	libpoppler-glib-dev_0.26.5-2+deb8u13_armhf.deb
Debian	8	armel	poppler-dbg	< 0.26.5-2+deb8u13	poppler-dbg_0.26.5-2+deb8u13_armel.deb