Bug 28142 - poppler security issue CVE-2020-35702
Summary: poppler security issue CVE-2020-35702
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact: Sec team
URL: https://nvd.nist.gov/vuln/detail/CVE-...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-01-17 12:12 CET by Zombie Ryushu
Modified: 2021-01-17 17:41 CET (History)
0 users

See Also:
Source RPM: poppler-20.12.1-1.mga8.src.rpm
CVE: CVE-2020-35702
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Zombie Ryushu 2021-01-17 12:12:46 CET 
** DISPUTED ** DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects.
Zombie Ryushu 2021-01-17 12:13:06 CET

CVE: (none) => CVE-2020-35702

Comment 1 David Walser 2021-01-17 17:41:16 CET 
Obviously INVALID.

Status: NEW => RESOLVED
Resolution: (none) => INVALID
Note You need to log in before you can comment on or make changes to this bug.