{"affected":[{"ecosystem_specific":{"binaries":[{"libpoppler73":"0.62.0-4.6.1","libpoppler73-32bit":"0.62.0-4.6.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.3","name":"poppler","purl":"pkg:rpm/opensuse/poppler&distro=openSUSE%20Leap%2015.3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for poppler fixes the following issues:\n\n- CVE-2017-18267: Fixed an infinite recursion that would allow remote attackers to cause a denial of service (bsc#1092945).\n- CVE-2018-13988: Added an improper implementation check which otherwise could allow buffer overflows, memory corruption, and denial of service (bsc#1102531).\n- CVE-2018-16646: Fixed an infinite recursion which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1107597).\n- CVE-2018-18897: Fixed a memory leak (bsc#1114966).\n- CVE-2018-19058: Fixed a bug which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1115187).\n- CVE-2018-19059: Fixed an out-of-bounds read access which could allow a denial-of-service attack (bsc#1115186).\n- CVE-2018-19060: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115185).\n- CVE-2018-19149: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115626).\n- CVE-2018-20481: Fixed a NULL pointer dereference while handling unallocated XRef entries which could allow a denial-of-service attack (bsc#1120495).\n- CVE-2018-20551: Fixed a reachable assertion which could allow a denial-of-service attack through specially crafted PDF files (bsc#1120496).\n- CVE-2018-20650: Fixed a reachable assertion which could allow denial-of-service through specially crafted PDF files (bsc#1120939).\n- CVE-2018-20662: Fixed a bug which could potentially crash the running process by SIGABRT resulting in a denial-of-service attack through a specially crafted PDF file (bsc#1120956).\n- CVE-2019-10871: Fixed a heap-based buffer  over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc (bsc#1131696).\n- CVE-2019-10872: Fixed a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc (bsc#1131722).\n- CVE-2019-14494: Fixed a divide-by-zero error in the function SplashOutputDev::tilingPatternFill (bsc#1143950).\n- CVE-2019-7310: Fixed a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) that allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document (bsc#1124150).\n- CVE-2019-9200: Fixed a heap-based buffer underwrite which could allow denial-of-service attack through a specially crafted PDF file (bsc#1127329)\n- CVE-2019-9631: Fixed a heap-based buffer over-read  in the CairoRescaleBox.cc downsample_row_box_filter function (bsc#1129202).\n- CVE-2019-9903: Fixed excessive stack consumption in the Dict::find() method, which can be triggered by passing a crafted pdf file to the pdfunite binary (bsc#1130229).\n- CVE-2019-9959: Fixed integer overflow that made it possible to allocate a large memory chunk on the heap with a size controlled by an attacker (bsc#1142465).\n- CVE-2020-27778: Fixed buffer overflow vulnerability in pdftohtml (bsc#1179163).\n  ","id":"openSUSE-SU-2021:3854-1","modified":"2021-12-01T15:59:12Z","published":"2021-12-01T15:59:12Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TS7QPSEQIBQO7BALZOE3TN7IO7IMHK3Y/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1092945"},{"type":"REPORT","url":"https://bugzilla.suse.com/1102531"},{"type":"REPORT","url":"https://bugzilla.suse.com/1107597"},{"type":"REPORT","url":"https://bugzilla.suse.com/1114966"},{"type":"REPORT","url":"https://bugzilla.suse.com/1115185"},{"type":"REPORT","url":"https://bugzilla.suse.com/1115186"},{"type":"REPORT","url":"https://bugzilla.suse.com/1115187"},{"type":"REPORT","url":"https://bugzilla.suse.com/1115626"},{"type":"REPORT","url":"https://bugzilla.suse.com/1120495"},{"type":"REPORT","url":"https://bugzilla.suse.com/1120496"},{"type":"REPORT","url":"https://bugzilla.suse.com/1120939"},{"type":"REPORT","url":"https://bugzilla.suse.com/1120956"},{"type":"REPORT","url":"https://bugzilla.suse.com/1124150"},{"type":"REPORT","url":"https://bugzilla.suse.com/1127329"},{"type":"REPORT","url":"https://bugzilla.suse.com/1129202"},{"type":"REPORT","url":"https://bugzilla.suse.com/1130229"},{"type":"REPORT","url":"https://bugzilla.suse.com/1131696"},{"type":"REPORT","url":"https://bugzilla.suse.com/1131722"},{"type":"REPORT","url":"https://bugzilla.suse.com/1142465"},{"type":"REPORT","url":"https://bugzilla.suse.com/1143950"},{"type":"REPORT","url":"https://bugzilla.suse.com/1179163"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-18267"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-13988"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-16646"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18897"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19058"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19059"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19060"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-19149"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-20481"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-20551"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-20650"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-20662"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10871"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10872"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-14494"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-7310"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-9200"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-9631"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-9903"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-9959"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-27778"}],"related":["CVE-2017-18267","CVE-2018-13988","CVE-2018-16646","CVE-2018-18897","CVE-2018-19058","CVE-2018-19059","CVE-2018-19060","CVE-2018-19149","CVE-2018-20481","CVE-2018-20551","CVE-2018-20650","CVE-2018-20662","CVE-2019-10871","CVE-2019-10872","CVE-2019-14494","CVE-2019-7310","CVE-2019-9200","CVE-2019-9631","CVE-2019-9903","CVE-2019-9959","CVE-2020-27778"],"summary":"Security update for poppler","upstream":["CVE-2017-18267","CVE-2018-13988","CVE-2018-16646","CVE-2018-18897","CVE-2018-19058","CVE-2018-19059","CVE-2018-19060","CVE-2018-19149","CVE-2018-20481","CVE-2018-20551","CVE-2018-20650","CVE-2018-20662","CVE-2019-10871","CVE-2019-10872","CVE-2019-14494","CVE-2019-7310","CVE-2019-9200","CVE-2019-9631","CVE-2019-9903","CVE-2019-9959","CVE-2020-27778"]}