Bug 1665263 (CVE-2018-20650) - CVE-2018-20650 poppler: reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc
Summary: CVE-2018-20650 poppler: reachable Object::dictLookup assertion in FileSpec cl...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-20650
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1665264 1665265 1677028 1677029 1717788
Blocks: 1665262
TreeView+ depends on / blocked
 
Reported: 2019-01-10 20:09 UTC by Laura Pardo
Modified: 2019-09-29 15:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-06 13:21:27 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2022 0 None None None 2019-08-06 12:02:59 UTC
Red Hat Product Errata RHSA-2019:2713 0 None None None 2019-09-11 09:33:17 UTC

Description Laura Pardo 2019-01-10 20:09:02 UTC
A flaw was found in Poppler 0.72.0. A reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc file allows attackers to cause a denial of service due to the lack of a check for the dict data type.


References:
https://gitlab.freedesktop.org/poppler/poppler/issues/704

Upstream Patch:
https://gitlab.freedesktop.org/poppler/poppler/commit/de0c0b8324e776f0b851485e0fc9622fc35695b7

Comment 1 Laura Pardo 2019-01-10 20:09:17 UTC
Created mingw-poppler tracking bugs for this issue:

Affects: fedora-all [bug 1665265]


Created poppler tracking bugs for this issue:

Affects: fedora-all [bug 1665264]

Comment 2 Scott Gayou 2019-02-13 19:41:04 UTC
Reproducible on Red Hat Enterprise Linux 7.

```
Program received signal SIGABRT, Aborted.
0x00007ffff5b07207 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:55
55	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-13.el7.x86_64 expat-2.1.0-10.el7_3.x86_64 jbigkit-libs-2.0-11.el7.x86_64 libuuid-2.23.2-59.el7.x86_64
(gdb) bt
#0  0x00007ffff5b07207 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007ffff5b088f8 in __GI_abort () at abort.c:90
#2  0x00007ffff7a3c755 in dictLookupNF (key=<optimized out>, this=<optimized out>, this=<optimized out>, 
    obj=<optimized out>) at Object.h:323
#3  FileSpec::FileSpec (this=0x6362a0, fileSpecA=<optimized out>) at FileSpec.cc:131
#4  0x0000000000401977 in main (argc=2, argv=<optimized out>) at pdfdetach.cc:176
```

Comment 5 errata-xmlrpc 2019-08-06 12:02:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2022 https://access.redhat.com/errata/RHSA-2019:2022

Comment 6 Product Security DevOps Team 2019-08-06 13:21:27 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-20650

Comment 7 errata-xmlrpc 2019-09-11 09:33:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2713 https://access.redhat.com/errata/RHSA-2019:2713


Note You need to log in before you can comment on or make changes to this bug.