Poppler 0.74.0 pdfimages JBIG2Stream.cc readTextRegion PDF File input validation

Summaryinfo

A vulnerability categorized as critical has been discovered in Poppler 0.74.0. This issue affects the function JBIG2Stream::readTextRegion of the file JBIG2Stream.cc of the component pdfimages. Such manipulation as part of PDF File leads to input validation. This vulnerability is referenced as CVE-2019-9545. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Poppler 0.74.0 (Document Reader Software). It has been rated as critical. Affected by this issue is the function JBIG2Stream::readTextRegion of the file JBIG2Stream.cc of the component pdfimages. The manipulation as part of a PDF File leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

The bug was discovered 02/28/2019. The weakness was published 03/01/2019. This vulnerability is handled as CVE-2019-9545 since 03/01/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-131298. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Document Reader Software

Name

• Poppler

Version

• 0.74.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion