Homepage

NULL Pointer Dereference Affecting poppler-qt5-devel package, versions <0:0.66.0-11.el8_0.12

Severity

 Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
3.42% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-POPPLERQT5DEVEL-2539732
  • published10 Apr 2022
  • disclosed26 Dec 2018
Report a new vulnerability Found a mistake?

Introduced: 26 Dec 2018

CVE-2018-20481  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Oracle:8 poppler-qt5-devel to version 0:0.66.0-11.el8_0.12 or higher.
This issue was patched in ELSA-2019-2713.

NVD Description

Note: Versions mentioned in the description apply only to the upstream poppler-qt5-devel package and not the poppler-qt5-devel package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.