Ubuntu update for poppler

1) Division by zero

EUVDB-ID: #VU9877

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14518

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a floating point exception in the isImageInterpolationRequired() function in Splash.cc via a specially crafted PDF document. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Division by zero

EUVDB-ID: #VU9878

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14520

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a floating point exception in Splash::scaleImageYuXd() in Splash.cc. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU13371

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14617

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to a floating point exception in the ImageStream class in Stream.cc. A remote attacker can supply specially crafted PDF files, bypass security restrictions and conduct further attacks.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Infinite loop

EUVDB-ID: #VU10325

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14929

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loop in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill and Gfx::drawForm calls. A remote attacker can trigger memory corruption and cause the service to crash.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer derefenrece

EUVDB-ID: #VU8651

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14975

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.

The vulnerability exists due to an error in FoFiType1C::convertToType0 function in FoFiType1C.cc when processing documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.

Successful exploitation of the vulnerability may allow an attacker to cause application crash.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer derefenrece

EUVDB-ID: #VU8652

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14977

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.

The vulnerability exists due to an error in FoFiTrueType::getCFFBlock function in FoFiTrueType.cc when processing documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.

Successful exploitation of the vulnerability may allow an attacker to cause application crash.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) NULL pointer derefenrece

EUVDB-ID: #VU8657

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14926

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.

The vulnerability exists due to an error in AnnotRichMedia::Content::Content in Annot.cc when processing PDF documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.

Successful exploitation of the vulnerability may allow an attacker to cause application crash.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) NULL pointer derefenrece

EUVDB-ID: #VU8658

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-14928

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial of service (DoS) conditions.

The vulnerability exists due to an error in AnnotRichMedia::Configuration::Configuration in Annot.cc when processing PDF documents. A remote attacker can send a specially crafted document, trigger NULL pointer dereference and perform a denial of service attack.

Successful exploitation of the vulnerability may allow an attacker to cause application crash.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Integer overflow

EUVDB-ID: #VU7272

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9776

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when processing PDF files within JBIG2Stream.cc in pdftocairo in Poppler before 0.56. A remote unauthenticated attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages

Ubuntu 17.04:

libpoppler64 0.48.0-2ubuntu2.3

poppler-utils 0.48.0-2ubuntu2.3

Ubuntu 16.04 LTS:

libpoppler58 0.41.0-0ubuntu1.4

poppler-utils 0.41.0-0ubuntu1.4

Ubuntu 14.04 LTS:

poppler-utils 0.24.5-2ubuntu4.7

libpoppler44 0.24.5-2ubuntu4.7

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

http://www.ubuntu.com/usn/usn-3440-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	9
CVE-ID	CVE-2017-14518 CVE-2017-14520 CVE-2017-14617 CVE-2017-14929 CVE-2017-14975 CVE-2017-14977 CVE-2017-14926 CVE-2017-14928 CVE-2017-9776
CWE-ID	CWE-369 CWE-20 CWE-835 CWE-476 CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system
Vendor	Canonical Ltd.