CVE-2019-9903

moderate-risk

Published 2019-03-21

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

Do I need to act?

0.73% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Poppler

Fedora

Debian Linux

Ubuntu Linux

Enterprise Linux

Enterprise Linux Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Affected Vendors

Debian Redhat Canonical Fedoraproject Freedesktop

References (18)

Broken Link http://www.securityfocus.com/bid/107560

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2713

Exploit https://gitlab.freedesktop.org/poppler/poppler/issues/741

Mailing List https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Exploit https://research.loginsoft.com/bugs/stack-based-buffer-overflows-in-dictfind-pop...

Third Party Advisory https://usn.ubuntu.com/4042-1/

Broken Link http://www.securityfocus.com/bid/107560

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2713

Exploit https://gitlab.freedesktop.org/poppler/poppler/issues/741

Mailing List https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Exploit https://research.loginsoft.com/bugs/stack-based-buffer-overflows-in-dictfind-pop...

Third Party Advisory https://usn.ubuntu.com/4042-1/

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 20/34 · Moderate