CVE-2017-9865

Summary

CVE	CVE-2017-9865
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-06-25 13:29:00 UTC
Updated	2019-10-03 00:03:00 UTC
Description	The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc.

Risk And Classification

Problem Types: CWE-125

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Application	Freedesktop	Poppler	0.54.0	All	All	All
Application	Freedesktop	Poppler	0.54.0	All	All	All

References

Reference	Source	Link	Tags
Debian -- Security Information -- DSA-4079-1 poppler	DEBIAN	www.debian.org	Third Party Advisory
100774 – poppler 0.54.0: stack buffer overflow in GfxImageColorMap::getGray (CVE-2017-9865)	MISC	bugs.freedesktop.org	Issue Tracking, Vendor Advisory
USN-4042-1: poppler vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com
Poppler: Multiple vulnerabilities (GLSA 201801-17) — Gentoo security	GENTOO	security.gentoo.org	Third Party Advisory
Poppler:stack buffer overflow in GfxImageColorMap::getGray	MISC	somevulnsofadlab.blogspot.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

670244 EulerOS Security Update for poppler (EulerOS-SA-2021-1832)
670920 EulerOS Security Update for poppler (EulerOS-SA-2021-1832)
710229 Gentoo Linux Poppler Multiple Vulnerabilities (GLSA 201801-17)