Medium: poppler

2016-11-1812:30:00

alas.aws.amazon.com

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.034 Low

EPSS

Percentile

91.5%

JSON

Issue Overview:

A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler to crash or, potentially, execute arbitrary code when opened.

Affected Packages:

poppler

Issue Correction:
Run yum update poppler to update your system.

New Packages:

i686:  
    poppler-cpp-devel-0.22.5-6.16.amzn1.i686  
    poppler-glib-0.22.5-6.16.amzn1.i686  
    poppler-devel-0.22.5-6.16.amzn1.i686  
    poppler-0.22.5-6.16.amzn1.i686  
    poppler-cpp-0.22.5-6.16.amzn1.i686  
    poppler-debuginfo-0.22.5-6.16.amzn1.i686  
    poppler-glib-devel-0.22.5-6.16.amzn1.i686  
    poppler-utils-0.22.5-6.16.amzn1.i686  
  
src:  
    poppler-0.22.5-6.16.amzn1.src  
  
x86_64:  
    poppler-debuginfo-0.22.5-6.16.amzn1.x86_64  
    poppler-utils-0.22.5-6.16.amzn1.x86_64  
    poppler-glib-0.22.5-6.16.amzn1.x86_64  
    poppler-0.22.5-6.16.amzn1.x86_64  
    poppler-cpp-0.22.5-6.16.amzn1.x86_64  
    poppler-glib-devel-0.22.5-6.16.amzn1.x86_64  
    poppler-devel-0.22.5-6.16.amzn1.x86_64  
    poppler-cpp-devel-0.22.5-6.16.amzn1.x86_64

Additional References

Red Hat: CVE-2015-8868

Mitre: CVE-2015-8868

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686poppler-cpp-devel< 0.22.5-6.16.amzn1poppler-cpp-devel-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler-glib< 0.22.5-6.16.amzn1poppler-glib-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler-devel< 0.22.5-6.16.amzn1poppler-devel-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler< 0.22.5-6.16.amzn1poppler-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler-cpp< 0.22.5-6.16.amzn1poppler-cpp-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler-debuginfo< 0.22.5-6.16.amzn1poppler-debuginfo-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler-glib-devel< 0.22.5-6.16.amzn1poppler-glib-devel-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1i686poppler-utils< 0.22.5-6.16.amzn1poppler-utils-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux1x86_64poppler-debuginfo< 0.22.5-6.16.amzn1poppler-debuginfo-0.22.5-6.16.amzn1.x86_64.rpm
Amazon Linux1x86_64poppler-utils< 0.22.5-6.16.amzn1poppler-utils-0.22.5-6.16.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	poppler-cpp-devel	< 0.22.5-6.16.amzn1	poppler-cpp-devel-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-glib	< 0.22.5-6.16.amzn1	poppler-glib-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-devel	< 0.22.5-6.16.amzn1	poppler-devel-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler	< 0.22.5-6.16.amzn1	poppler-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-cpp	< 0.22.5-6.16.amzn1	poppler-cpp-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-debuginfo	< 0.22.5-6.16.amzn1	poppler-debuginfo-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-glib-devel	< 0.22.5-6.16.amzn1	poppler-glib-devel-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	i686	poppler-utils	< 0.22.5-6.16.amzn1	poppler-utils-0.22.5-6.16.amzn1.i686.rpm
Amazon Linux	1	x86_64	poppler-debuginfo	< 0.22.5-6.16.amzn1	poppler-debuginfo-0.22.5-6.16.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	poppler-utils	< 0.22.5-6.16.amzn1	poppler-utils-0.22.5-6.16.amzn1.x86_64.rpm