what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Open Source CERT Security Advisory 2008.7

Open Source CERT Security Advisory 2008.7
Posted Jul 10, 2008
Authored by Andrea Barisani, Open Source CERT | Site ocert.org

The Poppler PDF rendering library versions 0.8.4 and below suffers from a memory management bug which can allows for arbitrary code execution.

tags | advisory, arbitrary, code execution
advisories | CVE-2008-2950
SHA-256 | 0f357fc416cd3be3d0207302a38ee42eb9121ef982844b3425f2e54b4376193c

Open Source CERT Security Advisory 2008.7

Change Mirror Download

2008/07/07 #2008-007 libpoppler uninitialized pointer

Description:

The poppler PDF rendering library suffers a memory management bug which leads
to arbitrary code execution.

The vulnerability is present in the Page class constructor/destructor. The
pageWidgets object is not initialized in the Page constructor if specific
conditions are met, but it is deleted afterwards in the destructor regardless
of its initialization.

Specific PDF files can be crafted which allocate arbitrary memory to trigger
the vulnerability.

A new poppler version addressing the issue is scheduled to be released on
July 30th according to maintainer.

The following patch fixes the issue:


diff --git a/poppler/Page.cc b/poppler/Page.cc
index b28a3ee..72a706b 100644
--- a/poppler/Page.cc
+++ b/poppler/Page.cc
@@ -230,7 +230,7 @@ GBool PageAttrs::readBox(Dict *dict, char *key, PDFRectangle *box) {

Page::Page(XRef *xrefA, int numA, Dict *pageDict, PageAttrs *attrsA, Form *form) {
Object tmp;
-
+ pageWidgets = NULL; //Security fix
ok = gTrue;
xref = xrefA;
num = numA;


Affected version:

poppler <= 0.8.4

Fixed version:

poppler, N/A

Credit: vulnerability report, patch and PoC code received from Felipe Andres
Manzano <fmanzano [at] fceia [dot] unr [dot] edu [dot] ar>.

CVE: CVE-2008-2950

Timeline:
2008-06-27: vulnerability report received
2008-06-28: contacted poppler maintainers and affected vendors
2008-06-30: maintainer confirms issue and patch
2008-07-07: advisory release

References:

Links:
http://poppler.freedesktop.org

Permalink:
http://www.ocert.org/advisories/ocert-2008-007.html

--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team

<lcars@ocert.org> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close