[arch-security] [ASA-201706-33] poppler: arbitrary code execution

[Santiago Torres-Arias]

Arch Linux Security Advisory ASA-201706-33
==========================================

Severity: High
Date    : 2017-06-26
CVE-ID  : CVE-2017-9775 CVE-2017-9776
Package : poppler
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-326

Summary
=======

The package poppler before version 0.56.0-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 0.56.0-1.

# pacman -Syu "poppler>=0.56.0-1"

The problems have been fixed upstream in version 0.56.0.

Workaround
==========

None.

Description
===========

- CVE-2017-9775 (arbitrary code execution)

A stack buffer overflow in has been found in GfxState.cc's module of
poppler. Due to some restrictions in the lines after the bug, an
attacker can't control the values written in the stack so it unlikely
this could lead to a code execution.

- CVE-2017-9776 (arbitrary code execution)

Integer overflow leading to heap overflow in JBIG2Stream.cc.

Impact
======

An attacker might be able to execute arbitrary code on the affected
host by tricking the user into opening a crafted PDF document.

References
==========

https://bugs.freedesktop.org/show_bug.cgi?id=101541
https://bugs.freedesktop.org/show_bug.cgi?id=101540
https://cgit.freedesktop.org/poppler/poppler/commit/?id=8f4ff8243a3d599ff2a6c08b1da389e606ba4fc9
https://cgit.freedesktop.org/poppler/poppler/commit/?id=a3a98a6d83dfbf49f565f5aa2d7c07153a7f62fc
https://security.archlinux.org/CVE-2017-9775
https://security.archlinux.org/CVE-2017-9776
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170626/8ef4ed86/attachment.asc>