[v2.2] Vulnerability in poppler < 0.22.1 allows remote denial of service
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1788
poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an “invalid memory access” in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
- Fix invalid memory access in 1150.pdf.asan.8.69 [1].
- Fix invalid memory access in 2030.pdf.asan.69.463 [2].
- Fix another invalid memory access in 1091.pdf.asan.72.42 [3].
- Fix invalid memory accesses in 1091.pdf.asan.72.42 [4].
- Fix invalid memory accesses in 1036.pdf.asan.23.17 [5].
[1]
http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492
[2]
http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=e14b6e9c13d35c9bd1e0c50906ace8e707816888
[3]
http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=0388837f01bc467045164f9ddaff787000a8caaa
[4]
http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=957aa252912cde85d76c41e9710b33425a82b696
[5]
http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=bbc2d8918fe234b7ef2c480eb148943922cc0959
(from redmine: issue id 1786, created on 2013-04-17, closed on 2013-05-03)