[SECURITY] [DLA 1074-1] poppler security update

2017-08-2916:56:46

lists.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.27 Low

EPSS

Percentile

96.8%

JSON

Package : poppler
Version : 0.18.4-6+deb7u2
CVE ID : CVE-2013-4473 CVE-2013-4474 CVE-2017-9775 CVE-2017-9776
CVE-2017-9865

Several buffer and integer overflow issues were discovered in Poppler,
a PDF library, that could lead to application crash or possibly other
unspecified impact via maliciously crafted files.

For Debian 7 "Wheezy", these problems have been fixed in version
0.18.4-6+deb7u2.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9i386gir1.2-poppler-0.18< 0.48.0-2+deb9u1gir1.2-poppler-0.18_0.48.0-2+deb9u1_i386.deb
Debian8ppc64ellibpoppler-qt4-4< 0.26.5-2+deb8u4libpoppler-qt4-4_0.26.5-2+deb8u4_ppc64el.deb
Debian7armelpoppler-utils< 0.18.4-6+deb7u2poppler-utils_0.18.4-6+deb7u2_armel.deb
Debian7amd64poppler-dbg< 0.18.4-6+deb7u2poppler-dbg_0.18.4-6+deb7u2_amd64.deb
Debian9mipselpoppler-dbg< 0.48.0-2+deb9u1poppler-dbg_0.48.0-2+deb9u1_mipsel.deb
Debian8arm64libpoppler-cpp-dev< 0.26.5-2+deb8u4libpoppler-cpp-dev_0.26.5-2+deb8u4_arm64.deb
Debian9mipsellibpoppler-glib8< 0.48.0-2+deb9u1libpoppler-glib8_0.48.0-2+deb9u1_mipsel.deb
Debian8mipslibpoppler-glib8< 0.26.5-2+deb8u4libpoppler-glib8_0.26.5-2+deb8u4_mips.deb
Debian7i386libpoppler-qt4-dev< 0.18.4-6+deb7u2libpoppler-qt4-dev_0.18.4-6+deb7u2_i386.deb
Debian8mipslibpoppler-dev< 0.26.5-2+deb8u4libpoppler-dev_0.26.5-2+deb8u4_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	i386	gir1.2-poppler-0.18	< 0.48.0-2+deb9u1	gir1.2-poppler-0.18_0.48.0-2+deb9u1_i386.deb
Debian	8	ppc64el	libpoppler-qt4-4	< 0.26.5-2+deb8u4	libpoppler-qt4-4_0.26.5-2+deb8u4_ppc64el.deb
Debian	7	armel	poppler-utils	< 0.18.4-6+deb7u2	poppler-utils_0.18.4-6+deb7u2_armel.deb
Debian	7	amd64	poppler-dbg	< 0.18.4-6+deb7u2	poppler-dbg_0.18.4-6+deb7u2_amd64.deb
Debian	9	mipsel	poppler-dbg	< 0.48.0-2+deb9u1	poppler-dbg_0.48.0-2+deb9u1_mipsel.deb
Debian	8	arm64	libpoppler-cpp-dev	< 0.26.5-2+deb8u4	libpoppler-cpp-dev_0.26.5-2+deb8u4_arm64.deb
Debian	9	mipsel	libpoppler-glib8	< 0.48.0-2+deb9u1	libpoppler-glib8_0.48.0-2+deb9u1_mipsel.deb
Debian	8	mips	libpoppler-glib8	< 0.26.5-2+deb8u4	libpoppler-glib8_0.26.5-2+deb8u4_mips.deb
Debian	7	i386	libpoppler-qt4-dev	< 0.18.4-6+deb7u2	libpoppler-qt4-dev_0.18.4-6+deb7u2_i386.deb
Debian	8	mips	libpoppler-dev	< 0.26.5-2+deb8u4	libpoppler-dev_0.26.5-2+deb8u4_mips.deb