CVE-2020-35702

** DISPUTED ** DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freedesktop:poppler:20.12.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-12-25 02:15

Updated : 2024-05-17 01:48

NVD link : CVE-2020-35702

Mitre link : CVE-2020-35702

CVE.ORG link : CVE-2020-35702

JSON object : View

Products Affected

freedesktop

poppler

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2020-35702", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-12-25T02:15:12.900", "references": [{"url": "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects"}, {"lang": "es", "value": "** EN DISPUTA ** La funci\u00f3n DCTStream::getChars en el archivo DCTStream.cc en Poppler versi\u00f3n 20.12.1, presenta un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria por medio de un documento PDF dise\u00f1ado. NOTA: informes posteriores indican que esto s\u00f3lo afecta a las construcciones de los clones de git de Poppler a finales de diciembre de 2020, no a la versi\u00f3n 20.12.1. En esta situaci\u00f3n, NO debe considerarse una vulnerabilidad del Poppler. Sin embargo, varios proyectos de c\u00f3digo abierto de terceros dependen directamente de clones de git Poppler hechos en momentos arbitrarios, y por lo tanto el CVE sigue siendo \u00fatil para los usuarios de esos proyectos"}], "lastModified": "2024-05-17T01:48:24.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freedesktop:poppler:20.12.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED965244-90F8-4284-A3E5-009B0154501F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}