SB2020040196 - Red Hat Enterprise Linux 7 update for poppler and evince
Published: April 1, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2018-21009)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in Parser::makeStream() function in Parser.cc. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Out-of-bounds read (CVE-ID: CVE-2019-10871)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function PSOutputDev::checkPageSlice in PSOutputDev.cc. A remote attacker can perform a denial of service attack.
3) Access of Uninitialized Pointer (CVE-ID: CVE-2019-11459)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due tothe TIFFReadRGBAImageOriented() function called from tiff_document_render() and tiff_document_get_thumbnail() functions in the backend/tiff/tiff-document.c in GNOME Evince returns uninitialized memory instead of false, when failing to read an image. A remote attacker can gain access to sensitive information on the system.
4) Out-of-bounds read (CVE-ID: CVE-2019-12293)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in JPXStream::init() function in JPEG2000Stream.cc via data with inconsistent heights or widths. A remote attacker can perform a denial of service attack.
5) Integer overflow (CVE-ID: CVE-2019-9959)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in the "JPXStream::init" function, caused by a failure to bounds-check user-supplied data before copying it to an undersized memory buffer. A remote attacker can supply crafted data to the system, trigger integer overflow and cause a denial of service condition on the targeted system.
Remediation
Install update from vendor's website.