CVE-2013-4474
NoneCVSS
—
EPSS
10.5%
Published
Nov 23, 2013
CISA due date
—
The record
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | poppler | 0 | 0.18.4-9 |
| Debian:11 | poppler | 0 | 0.18.4-9 |
| Debian:12 | poppler | 0 | 0.18.4-9 |
| Debian:13 | poppler | 0 | 0.18.4-9 |
| Debian:7 | poppler | 0 | 0.18.4-6+deb7u2 |
| Mageia:2 | poppler | 0 | 0.18.4-2.3.mga2 |
| Mageia:3 | poppler | 0 | 0.22.1-1.1.mga3 |
| Ubuntu:14.04:LTS | poppler | 0 | 0.24.3-0ubuntu1 |
| Ubuntu:14.04:LTS | poppler | 0 | 0.24.5-2ubuntu4.4 |
| openSUSE:Tumbleweed | poppler | 0 | 0.49.0-1.1 |
Related vulnerabilities
- CVE-2017-14518 In Poppler 0.59.0, a floating point exception exists in the… Also affects poppler
- CVE-2017-14517 In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function… Also affects poppler
- CVE-2017-2820 An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing… Also affects poppler
- CVE-2013-4473 Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in… Also affects poppler
- CVE-2009-3608 Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before… Also affects poppler
- CVE-2009-0755 The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote… Also affects poppler
- CVE-2009-0756 The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote… Also affects poppler
- CVE-2008-2950 The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a… Also affects poppler