Bug 1797453 (CVE-2019-14494)

Summary: CVE-2019-14494 poppler: divide-by-zero in function SplashOutputDev::tilingPatternFill in SplashOutputDev.cc
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: caillon+fedoraproject, feborges, gnome-sig, john.j5live, mclasen, mkasik, rdieter, rhughes, rstrode, sandmann
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: poppler 0.79.0 Doc Type: If docs needed, set a value
Doc Text:
A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by an application linked to Poppler, would crash the application causing a denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-29 21:59:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1797456, 1801340, 1801341    
Bug Blocks: 1797455    

Description Dhananjay Arunesh 2020-02-03 08:23:15 UTC
An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.


Comment 1 Dhananjay Arunesh 2020-02-03 08:24:27 UTC
Created poppler tracking bugs for this issue:

Affects: fedora-all [bug 1797456]

Comment 3 Mauro Matteo Cascella 2020-02-10 15:13:35 UTC
Function tilingPatternFill() was defined in SplashOutputDev.cc in Poppler upstream version 0.17.0 with commit https://gitlab.freedesktop.org/poppler/poppler/commit/abf167af.

Red Hat Enterprise Linux 5 and 6 ship older versions of Poppler (0.5.4 and 0.12.4 respectively) that do not include the vulnerable function and, consequently, are not affected by this flaw.

Comment 4 Mauro Matteo Cascella 2020-02-10 15:17:15 UTC

This flaw did not affect the versions of Poppler as shipped with Red Hat Enterprise Linux 5 and 6, as they did not include the vulnerable code.

Comment 7 errata-xmlrpc 2020-09-29 20:16:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3977 https://access.redhat.com/errata/RHSA-2020:3977

Comment 8 Product Security DevOps Team 2020-09-29 21:59:37 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 9 errata-xmlrpc 2020-11-04 02:36:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4643 https://access.redhat.com/errata/RHSA-2020:4643