CVE-2008-2950
published 2008-07-07CVE-2008-2950: The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor…
high7.5CVSS 3.1
AVNACLAuNCPIPAP
EXPLOIT
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | poppler | < poppler 0.8.4-1.1 (bookworm) | poppler 0.8.4-1.1 (bookworm) |
| debian | xpdf | < poppler 0.8.4-1.1 (bookworm) | poppler 0.8.4-1.1 (bookworm) |
| freedesktop | poppler | >= 0 < 0.8.4-1.1 | 0.8.4-1.1 |
| freedesktop | poppler | >= 0 < 0.8.4-1.1 | 0.8.4-1.1 |
| freedesktop | poppler | >= 0 < 0.8.4-1.1 | 0.8.4-1.1 |
| freedesktop | poppler | >= 0 < 0.8.4-1.1 | 0.8.4-1.1 |
| poppler | poppler | <= 0.8.4 | — |
CVSS provenance
nvd7.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH