| Descripción: | Summary:
The remote host is missing an update for the 'poppler' package(s) announced via the MGASA-2019-0244 advisory.
Vulnerability Insight:
Updated poppler packages fix security vulnerabilities
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc
downsample_row_box_filter function. (CVE-2019-9631)
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking,
leading to stack consumption in the function Dict::find() located at
Dict.cc, which can (for example) be triggered by passing a crafted pdf
file to the pdfunite binary. (CVE-2019-9903)
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function
PostScriptFunction::exec at Function.cc for the psOpIdiv case.
(CVE-2019-10018)
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function
ImageStream::ImageStream at Stream.cc for nComps. (CVE-2019-10021)
An issue was discovered in Xpdf 4.01.01. There is an FPE in the function
PostScriptFunction::exec at Function.cc for the psOpMod case.
(CVE-2019-10023)
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer
over-read in the function Splash::blitTransparent at splash/Splash.cc.
(CVE-2019-10872)
In Poppler through 0.76.1, there is a heap-based buffer over-read in
JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights
or widths. (CVE-2019-12293)
An issue was discovered in Poppler through 0.78.0. There is a
divide-by-zero error in the function SplashOutputDev::tilingPatternFill
at SplashOutputDev.cc. (CVE-2019-14494)
Affected Software/OS:
'poppler' package(s) on Mageia 6.
Solution:
Please install the updated package(s).
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
