Denial of Service Vulnerability in Poppler by FreeDesktop
CVE-2019-9545

8.8HIGH

Key Information:

Vendor

Freedesktop

Status
Poppler
Vendor
CVE Published:
1 March 2019
đź”” Create Freedesktop Vulnerability Alert

What is CVE-2019-9545?

A vulnerability exists in Poppler 0.74.0 due to a recursive function call in the JBIG2Stream::readTextRegion() method. Attackers can exploit this by sending a maliciously crafted PDF file to the pdfimages binary, resulting in a Denial of Service through a segmentation fault. This issue is associated with the JBIG2Bitmap::clearToZero operation, potentially leading to further unspecified impacts beyond the initial Denial of Service effect.

References

https://gitlab.freedesktop.org/poppler/poppler/issues/731
x_refsource_MISC
https://research.loginsoft.com/bugs/recursive-function-ca...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.