NULL Pointer Dereference Affecting libpoppler73 package, versions <0.62.0-4.6.1
Threat Intelligence
EPSS
2.44% (84th percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-SLES152-LIBPOPPLER73-2658265
- published14 Apr 2022
- disclosed1 Dec 2021
Introduced: 1 Dec 2021
CVE-2018-19149 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade SLES:15.2 libpoppler73 to version 0.62.0-4.6.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libpoppler73 package and not the libpoppler73 package as distributed by SLES.
See How to fix? for SLES:15.2 relevant fixed versions and status.
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
References
- https://www.suse.com/security/cve/CVE-2018-19149.html
- https://bugzilla.suse.com/1115626
- http://www.securityfocus.com/bid/106031
- https://access.redhat.com/errata/RHSA-2019:2022
- https://gitlab.freedesktop.org/poppler/poppler/issues/664
- https://security.gentoo.org/glsa/201904-04
- https://usn.ubuntu.com/3837-1/
- https://usn.ubuntu.com/3837-2/