The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4362-1 advisory.
CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm. (CVE-2018-18454)
The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm. (CVE-2018-18456)
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368. (CVE-2019-13287)
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1. (CVE-2019-14292)
An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero. (CVE-2019-9545)
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. (CVE-2019-9631)
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. (CVE-2020-36023)
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. (CVE-2022-37052)
An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
(CVE-2022-48545)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2023:4362-1. The text itself
# is copyright (C) SUSE.
##
include('compat.inc');
if (description)
{
script_id(184405);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/04");
script_cve_id(
"CVE-2018-18454",
"CVE-2018-18456",
"CVE-2019-9545",
"CVE-2019-9631",
"CVE-2019-13287",
"CVE-2019-14292",
"CVE-2020-36023",
"CVE-2022-37052",
"CVE-2022-48545"
);
script_xref(name:"SuSE", value:"SUSE-SU-2023:4362-1");
script_name(english:"SUSE SLES12 Security Update : poppler (SUSE-SU-2023:4362-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as
referenced in the SUSE-SU-2023:4362-1 advisory.
- CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service
(heap-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm. (CVE-2018-18454)
- The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote
attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as
demonstrated by pdftoppm. (CVE-2018-18456)
- In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust()
located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to
the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to
CVE-2018-16368. (CVE-2019-13287)
- An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function
GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1. (CVE-2019-14292)
- An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion()
located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages
binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified
other impact. This is related to JBIG2Bitmap::clearToZero. (CVE-2019-9545)
- Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter
function. (CVE-2019-9631)
- An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial
of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. (CVE-2020-36023)
- A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service
due to a failure in markObject. (CVE-2022-37052)
- An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
(CVE-2022-48545)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1112424");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1112428");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1128114");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1129202");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1140745");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1143570");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1214256");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1214723");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1214726");
# https://lists.suse.com/pipermail/sle-security-updates/2023-November/016988.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?24074896");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-18454");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-18456");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-13287");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-14292");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9545");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9631");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-36023");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-37052");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-48545");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9631");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/18");
script_set_attribute(attribute:"patch_publication_date", value:"2023/11/03");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/04");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler-cpp0");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler-glib-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler-glib8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler-qt4-4");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler-qt4-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpoppler60");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:poppler-tools");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:typelib-1_0-Poppler-0_18");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"SuSE Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)(?:_SAP)?\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES12|SLES_SAP12)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES12 / SLES_SAP12', 'SUSE (' + os_ver + ')');
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);
var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(5)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES12 SP5", os_ver + " SP" + service_pack);
if (os_ver == "SLES_SAP12" && (! preg(pattern:"^(5)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES_SAP12 SP5", os_ver + " SP" + service_pack);
var pkgs = [
{'reference':'libpoppler-cpp0-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler-devel-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler-glib-devel-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler-glib8-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler-qt4-4-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler-qt4-devel-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler60-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'poppler-tools-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'typelib-1_0-Poppler-0_18-0.43.0-16.40.1', 'sp':'5', 'release':'SLES_SAP12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-12.5']},
{'reference':'libpoppler-cpp0-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-sdk-release-12.5', 'sles-release-12.5']},
{'reference':'libpoppler-devel-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-sdk-release-12.5', 'sles-release-12.5']},
{'reference':'libpoppler-glib-devel-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-sdk-release-12.5', 'sles-release-12.5']},
{'reference':'libpoppler-qt4-devel-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-sdk-release-12.5', 'sles-release-12.5']},
{'reference':'typelib-1_0-Poppler-0_18-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-sdk-release-12.5', 'sles-release-12.5']},
{'reference':'libpoppler-glib8-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.5']},
{'reference':'libpoppler-qt4-4-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.5']},
{'reference':'libpoppler60-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.5']},
{'reference':'poppler-tools-0.43.0-16.40.1', 'sp':'5', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.5']}
];
var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var exists_check = NULL;
var rpm_spec_vers_cmp = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (reference && _release) {
if (exists_check) {
var check_flag = 0;
foreach var check (exists_check) {
if (!rpm_exists(release:_release, rpm:check)) continue;
check_flag++;
}
if (!check_flag) continue;
}
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc');
}
Vendor | Product | Version | CPE |
---|---|---|---|
novell | suse_linux | libpoppler-cpp0 | p-cpe:/a:novell:suse_linux:libpoppler-cpp0 |
novell | suse_linux | libpoppler-devel | p-cpe:/a:novell:suse_linux:libpoppler-devel |
novell | suse_linux | libpoppler-glib-devel | p-cpe:/a:novell:suse_linux:libpoppler-glib-devel |
novell | suse_linux | libpoppler-glib8 | p-cpe:/a:novell:suse_linux:libpoppler-glib8 |
novell | suse_linux | libpoppler-qt4-4 | p-cpe:/a:novell:suse_linux:libpoppler-qt4-4 |
novell | suse_linux | libpoppler-qt4-devel | p-cpe:/a:novell:suse_linux:libpoppler-qt4-devel |
novell | suse_linux | libpoppler60 | p-cpe:/a:novell:suse_linux:libpoppler60 |
novell | suse_linux | poppler-tools | p-cpe:/a:novell:suse_linux:poppler-tools |
novell | suse_linux | typelib-1_0-poppler-0_18 | p-cpe:/a:novell:suse_linux:typelib-1_0-poppler-0_18 |
novell | suse_linux | 12 | cpe:/o:novell:suse_linux:12 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18454
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18456
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13287
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14292
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9545
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9631
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36023
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37052
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48545
www.nessus.org/u?24074896
bugzilla.suse.com/1112424
bugzilla.suse.com/1112428
bugzilla.suse.com/1128114
bugzilla.suse.com/1129202
bugzilla.suse.com/1140745
bugzilla.suse.com/1143570
bugzilla.suse.com/1214256
bugzilla.suse.com/1214723
bugzilla.suse.com/1214726
www.suse.com/security/cve/CVE-2018-18454
www.suse.com/security/cve/CVE-2018-18456
www.suse.com/security/cve/CVE-2019-13287
www.suse.com/security/cve/CVE-2019-14292
www.suse.com/security/cve/CVE-2019-9545
www.suse.com/security/cve/CVE-2019-9631
www.suse.com/security/cve/CVE-2020-36023
www.suse.com/security/cve/CVE-2022-37052
www.suse.com/security/cve/CVE-2022-48545