CVE-2013-4473
Published: 23 November 2013
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
poppler Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
(code not present)
|
| precise |
Released
(0.18.4-1ubuntu3.2)
|
|
| quantal |
Ignored
(end of life)
|
|
| raring |
Ignored
(end of life)
|
|
| saucy |
Ignored
(end of life)
|
|
| trusty |
Does not exist
(trusty was not-affected [0.24.3-0ubuntu1])
|
|
| upstream |
Released
(0.24.2)
|
|
| utopic |
Not vulnerable
(0.24.3-0ubuntu1)
|
|
| vivid |
Not vulnerable
(0.24.3-0ubuntu1)
|
|
| wily |
Not vulnerable
(0.24.3-0ubuntu1)
|
|
| xenial |
Not vulnerable
(0.24.3-0ubuntu1)
|
|
|
Patches: upstream: http://cgit.freedesktop.org/poppler/poppler/commit/?id=b8682d868ddf7f741e93b791588af0932893f95c vendor: http://anonscm.debian.org/cgit/pkg-freedesktop/poppler.git/tree/debian/patches/upstream_pdfseparate-improve-the-path-building.patch?id=03dc7c0c4ab7d792eecbd94234e1b46f2fbcf6c9 |
||
| This vulnerability is mitigated in part by the use of gcc's stack protector in Ubuntu. | ||