SB2017100611 - Ubuntu update for poppler
Published: October 6, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Division by zero (CVE-ID: CVE-2017-14518)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a floating point exception in the isImageInterpolationRequired() function in Splash.cc via a specially crafted PDF document. A remote attacker can perform a denial of service (DoS) attack.
2) Division by zero (CVE-ID: CVE-2017-14520)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a floating point exception in Splash::scaleImageYuXd() in Splash.cc. A remote attacker can perform a denial of service (DoS) attack.
3) Improper input validation (CVE-ID: CVE-2017-14617)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to a floating point exception in the ImageStream class in Stream.cc. A remote attacker can supply specially crafted PDF files, bypass security restrictions and conduct further attacks.
4) Infinite loop (CVE-ID: CVE-2017-14929)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to infinite loop in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill and Gfx::drawForm calls. A remote attacker can trigger memory corruption and cause the service to crash.
5) NULL pointer derefenrece (CVE-ID: CVE-2017-14975)
The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.
The vulnerability exists due to an error in FoFiType1C::convertToType0 function in FoFiType1C.cc when processing documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.
Successful exploitation of the vulnerability may allow an attacker to cause application crash.
6) NULL pointer derefenrece (CVE-ID: CVE-2017-14977)
The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.
The vulnerability exists due to an error in FoFiTrueType::getCFFBlock function in FoFiTrueType.cc when processing documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.
Successful exploitation of the vulnerability may allow an attacker to cause application crash.
7) NULL pointer derefenrece (CVE-ID: CVE-2017-14926)
The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.
The vulnerability exists due to an error in AnnotRichMedia::Content::Content in Annot.cc when processing PDF documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.
Successful exploitation of the vulnerability may allow an attacker to cause application crash.
8) NULL pointer derefenrece (CVE-ID: CVE-2017-14928)
The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.
The vulnerability exists due to an error in AnnotRichMedia::Configuration::Configuration in Annot.cc when processing PDF documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.
Successful exploitation of the vulnerability may allow an attacker to cause application crash.
9) Integer overflow (CVE-ID: CVE-2017-9776)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow when processing PDF files within JBIG2Stream.cc in pdftocairo in Poppler before 0.56. A remote unauthenticated attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.