CVE-2019-12293
High
Description
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
SeverityHigh
CVSS8.8
Exploit probability—
ProductFreedesktop Poppler
PublishedMay 23, 2019
First seenMay 23, 2019
How to fix
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWS7NVFFCUY3YSTMEKZEJEU6JVUUBKHB/
- usn.ubuntu.com/4042-1/
- access.redhat.com/errata/RHSA-2019:2713
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freedesktop poppler | v ≤ 0.76.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.