CVE-2017-9865 — Out-of-bounds Read in Poppler

CWE-125 — Out-of-bounds ReadCWE-121 — Stack-based Buffer Overflow10 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.8%
top 26.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Freedesktop PopplerDebian Linux
Timeline
PublishedJun 25
Latest updateMay 13

Description

The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶Debianfreedesktop/poppler< 0.57.0-2+3

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-jjgx-wvcc-8xv3: The function GfxImageColorMap::getGray in GfxState↗2022-05-13
▶
OSV
CVE-2017-9865: The function GfxImageColorMap::getGray in GfxState↗2017-06-25
▶
CVEList
CVE-2017-9865: The function GfxImageColorMap::getGray in GfxState↗2017-06-25
▶

📋Vendor Advisories

3
Ubuntu
poppler vulnerabilities↗2019-06-27
▶
Red Hat
poppler: Buffer over-read in the GfxImageColorMap::getGray function↗2017-04-24
▶
Debian
CVE-2017-9865: poppler - The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows r...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-9865 poppler: Buffer over-read in the GfxImageColorMap::getGray function↗2017-06-29
▶
Bugzilla
CVE-2017-7515 CVE-2017-9775 CVE-2017-9776 CVE-2017-9865 poppler: various flaws [fedora-all]↗2017-06-06
▶
Bugzilla
CVE-2017-7515 CVE-2017-9775 CVE-2017-9776 CVE-2017-9865 mingw-poppler: various flaws [fedora-all]↗2017-06-06
▶
CVE-2017-9865 — Out-of-bounds Read in Poppler | cvebase