libpoppler uninitialized pointer

Risk: High
Local: No
Remote: Yes

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

2008/07/07 #2008-007 libpoppler uninitialized pointer Description: The poppler PDF rendering library suffers a memory management bug which leads to arbitrary code execution. The vulnerability is present in the Page class constructor/destructor. The pageWidgets object is not initialized in the Page constructor if specific conditions are met, but it is deleted afterwards in the destructor regardless of its initialization. Specific PDF files can be crafted which allocate arbitrary memory to trigger the vulnerability. A new poppler version addressing the issue is scheduled to be released on July 30th according to maintainer. The following patch fixes the issue: diff --git a/poppler/ b/poppler/ index b28a3ee..72a706b 100644 --- a/poppler/ +++ b/poppler/ @@ -230,7 +230,7 @@ GBool PageAttrs::readBox(Dict *dict, char *key, PDFRectangle *box) { Page::Page(XRef *xrefA, int numA, Dict *pageDict, PageAttrs *attrsA, Form *form) { Object tmp; - + pageWidgets = NULL; //Security fix ok = gTrue; xref = xrefA; num = numA; Affected version: poppler <= 0.8.4 Fixed version: poppler, N/A Credit: vulnerability report, patch and PoC code received from Felipe Andres Manzano <fmanzano [at] fceia [dot] unr [dot] edu [dot] ar>. CVE: CVE-2008-2950 Timeline: 2008-06-27: vulnerability report received 2008-06-28: contacted poppler maintainers and affected vendors 2008-06-30: maintainer confirms issue and patch 2008-07-07: advisory release References: Links: Permalink: -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top