This vulnerability affects the official build of Poppler prior to version 22.08.0 on Ubuntu 14.04 LTS and 18.04. It does not affect Windows or other operating systems. Users running vulnerable versions of Poppler should update as soon as possible to protect against possible attack.

CVE-2018-5457 A heap-based buffer overflow was discovered in poppler-gd JBIG1/2 decoder that is used by Poppler to render PDF documents. A maliciously crafted PDF file could cause an application using Poppler to crash, resulting in a denial of service, or potentially execute arbitrary code. This vulnerability affects the official build of Poppler prior to version 22.08.0 on Ubuntu 14.04 LTS and 18.04. It does not affect Windows or other operating systems. Users running vulnerable versions of Poppler should update as soon as possible to protect against possible attack. CVE-2018-5457 was discovered by Dawid Golunski of LegalHackers.org.

Vulnerability overview

Both vulnerabilities, CVE-2022-38784 and CVE-2018-5457, are severe. The first vulnerability affects the official build of Poppler prior to version 22.08.0 on Ubuntu 14.04 LTS and 18.04 which is used by millions of people in packages for Linux. The second vulnerability affects the official build of Poppler prior to version 22.08.0 on Ubuntu 14.04 LTS and 18.04 which is used by millions of people as well, but this vulnerability also affects Windows users who might be using these packages in their work environment as well as other operating systems that use these vulnerable packages like CentOS or Red Hat Enterprise Linux 7 (RHEL 7).

Potential Impact

The risk of a successful attack is not currently known.

What is Poppler?

Poppler is a library designed to provide high-quality PDF rendering. It supports many different backends, including X11, Cairo, and Qt's Print Services. The goal of the project is to provide a unified interface to PDF generation through multiple backends.

Standard warning

Poppler is an open source PDF rendering library for Linux and other systems, used to display Portable Document Format files. It is the default PDF library in Ubuntu 18.04 LTS and was also available in previous versions of Ubuntu.
Poppler is vulnerable to a heap-based buffer overflow that affects its JBIG1/2 decoder, which could be exploited by a maliciously crafted PDF file to cause an application using Poppler to crash, resulting in denial of service or potentially execute arbitrary code. This vulnerability affects the official build of Poppler prior to version 22.08.0 on Ubuntu 14.04 LTS and 18.04. It does not affect Windows or other operating systems. Users running vulnerable versions of Poppler should update as soon as possible to protect against possible attack.

Timeline

Published on: 08/30/2022 03:15:00 UTC
Last modified on: 09/26/2022 02:15:00 UTC

References