Ubuntu update for poppler



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2024-6239
CVE-2017-8981
CVE-2017-8982
CVE-2017-8980
CWE-ID CWE-20
CWE-264
CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

libpoppler118 (Ubuntu package)
Operating systems & Components / Operating system package or component

poppler-utils (Ubuntu package)
Operating systems & Components / Operating system package or component

libpoppler134 (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU93868

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-6239

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Pdfinfo utility. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package poppler to the latest version.

Vulnerable software versions

Ubuntu: 22.04 - 24.04

libpoppler118 (Ubuntu package): before 22.02.0-2ubuntu0.5

poppler-utils (Ubuntu package): before 22.02.0-2ubuntu0.5

libpoppler134 (Ubuntu package): before 24.02.0-1ubuntu9.1

CPE2.3 External links

http://ubuntu.com/security/notices/USN-6915-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Remote code execution

EUVDB-ID: #VU10259

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-8981

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists in HPE Intelligent Management Center (iMC) PLAT due to unspecified condition . A remote attacker can execute arbitrary code ans compromise the vulnerable system.

Mitigation

Update the affected package poppler to the latest version.

Vulnerable software versions

Ubuntu: 22.04 - 24.04

libpoppler118 (Ubuntu package): before 22.02.0-2ubuntu0.5

poppler-utils (Ubuntu package): before 22.02.0-2ubuntu0.5

libpoppler134 (Ubuntu package): before 24.02.0-1ubuntu9.1

CPE2.3 External links

http://ubuntu.com/security/notices/USN-6915-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU10258

Risk: Low

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8982

CWE-ID: CWE-200 - Information exposure

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists in HPE Intelligent Management Center (iMC) PLAT due to improper authentication. A remote attacker can bypass authentication and gain access to important data.

Mitigation

Update the affected package poppler to the latest version.

Vulnerable software versions

Ubuntu: 22.04 - 24.04

libpoppler118 (Ubuntu package): before 22.02.0-2ubuntu0.5

poppler-utils (Ubuntu package): before 22.02.0-2ubuntu0.5

libpoppler134 (Ubuntu package): before 24.02.0-1ubuntu9.1

CPE2.3 External links

http://ubuntu.com/security/notices/USN-6915-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Information disclosure

EUVDB-ID: #VU10220

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-8980

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists in HPE Intelligent Management Center (iMC) PLAT due to an unspecified condition. A remote attacker can gain access to arbitrary data that can be used to conduct further attacks.

Mitigation

Update the affected package poppler to the latest version.

Vulnerable software versions

Ubuntu: 22.04 - 24.04

libpoppler118 (Ubuntu package): before 22.02.0-2ubuntu0.5

poppler-utils (Ubuntu package): before 22.02.0-2ubuntu0.5

libpoppler134 (Ubuntu package): before 24.02.0-1ubuntu9.1

CPE2.3 External links

http://ubuntu.com/security/notices/USN-6915-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###