Integer Overflow in Poppler Affects JPXStream Function

CVE-2019-9959

What is CVE-2019-9959?

The JPXStream::init function in Poppler versions up to 0.78.0 exhibits a critical flaw where it fails to validate the stream length, allowing for an integer overflow. This vulnerability can be exploited by attackers to allocate an excessive amount of memory on the heap, leading to potential resource exhaustion and application instability. By manipulating input values, an attacker can leverage this issue in various tools utilizing the library, such as pdftocairo, thereby posing a significant risk for systems employing an affected version of Poppler.

References