Lucene search

Veracode Vulnerability DatabaseVERACODE:43720

HistoryOct 10, 2023 - 12:32 p.m.

Denial Of Service (DoS)

2023-10-1012:32:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

libpoppler.so

vulnerability

crafting

malicious pdf

recursion

catalog::finddestintree

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

12.1%

JSON

libpoppler.so is vulnerable to Denial of Service (DoS). An infinite recursion in the Catalog::findDestInTree function allows an attacker to exploit this vulnerability by crafting a malicious PDF file that will cause the library to crash.

CPENameOperatorVersion
libpoppler.sole131.0.0
libpoppler.sole131.0.0
xpdf:3.19eq4.04-r0
xpdf:edgeeq3.04-r4
xpdf:edgeeq4.03-r0
xpdf:edgeeq4.04-r0

Name	Operator	Version
libpoppler.so	le	131.0.0
libpoppler.so	le	131.0.0
xpdf:3.19	eq	4.04-r0
xpdf:edge	eq	3.04-r4
xpdf:edge	eq	4.03-r0
xpdf:edge	eq	4.04-r0

References

bugzilla.suse.com/show_bug.cgi?id=1214723

forum.xpdfreader.com/viewtopic.php?f=3&t=42092

github.com/advisories/GHSA-x23x-4p2x-538q

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

12.1%

JSON

Related for VERACODE:43720