Bugzilla – Bug 1214664
VUL-0: CVE-2020-18839: poppler: buffer overflow in HtmlOutputDev::page
Last modified: 2023-09-19 14:35:38 UTC
CVE-2020-18839 Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service. Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/742 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-18839 https://bugzilla.redhat.com/show_bug.cgi?id=2234524 https://www.cve.org/CVERecord?id=CVE-2020-18839 https://gitlab.freedesktop.org/poppler/poppler/issues/742
I could not reproduce with TW,15sp4,15sp2,15,12sp2,12/poppler. $ valgrind -q pdftohtml poc -f 1 /dev/null Syntax Error (738): Dictionary key must be a name object Syntax Error (751): Dictionary key must be a name object Syntax Error (758): Illegal character '>' Syntax Error (763): Dictionary key must be a name object Syntax Error (769): Dictionary key must be a name object Syntax Error (798): Illegal character ')' Syntax Error (798): Dictionary key must be a name object Syntax Error (820): Dictionary key must be a name object Syntax Error (820): Illegal character '{' Syntax Error (820): Dictionary key must be a name object Syntax Error (846): Dictionary key must be a name object Syntax Error (846): Dictionary key must be a name object Syntax Error (849): Dictionary key must be a name object Syntax Error (849): Illegal character '{' Syntax Error (849): Dictionary key must be a name object Syntax Error (899): Dictionary key must be a name object Syntax Error (899): Illegal character ')' Syntax Error (899): Dictionary key must be a name object Syntax Error (905): Dictionary key must be a name object Syntax Error (905): Dictionary key must be a name object Syntax Error (916): Dictionary key must be a name object Syntax Error (926): Dictionary key must be a name object Syntax Error (933): Dictionary key must be a name object Syntax Error (935): Dictionary key must be a name object Syntax Error (937): Dictionary key must be a name object Syntax Error (941): Dictionary key must be a name object Syntax Error (943): Dictionary key must be a name object Syntax Error (950): Dictionary key must be a name object Syntax Error (738): Dictionary key must be a name object Syntax Error (751): Dictionary key must be a name object Syntax Error (758): Illegal character '>' Syntax Error (763): Dictionary key must be a name object Syntax Error (769): Dictionary key must be a name object Syntax Error (798): Illegal character ')' Syntax Error (798): Dictionary key must be a name object Syntax Error (820): Dictionary key must be a name object Syntax Error (820): Illegal character '{' Syntax Error (820): Dictionary key must be a name object Syntax Error (846): Dictionary key must be a name object Syntax Error (846): Dictionary key must be a name object Syntax Error (849): Dictionary key must be a name object Syntax Error (849): Illegal character '{' Syntax Error (849): Dictionary key must be a name object Syntax Error (899): Dictionary key must be a name object Syntax Error (899): Illegal character ')' Syntax Error (899): Dictionary key must be a name object Syntax Error (905): Dictionary key must be a name object Syntax Error (905): Dictionary key must be a name object Syntax Error (916): Dictionary key must be a name object Syntax Error (926): Dictionary key must be a name object Syntax Error (933): Dictionary key must be a name object Syntax Error (935): Dictionary key must be a name object Syntax Error (937): Dictionary key must be a name object Syntax Error (941): Dictionary key must be a name object Syntax Error (943): Dictionary key must be a name object Syntax Error (950): Dictionary key must be a name object Syntax Error: Loop in Pages tree $ Only 12/poppler is missing the patch.
(In reply to Petr Gajdos from comment #1) > Only 12/poppler is missing the patch. Ah nope. Even 12/poppler is already fixed. This is because we solved upstream bug 742 trough CVE-2020-27778. So this is sort of duplicate of CVE-2020-27778 bsc#1179163. 12sp2,12/poppler has CVE-2020-27778.patch 15+/poppler has this in upstream tarball already