1130999 – (CVE-2019-10024) VUL-1: CVE-2019-10024: xpdf: floating point exception in function Splash:scaleImageYuXu in Splash.c

Bug 1130999 (CVE-2019-10024) - VUL-1: CVE-2019-10024: xpdf: floating point exception in function Splash:scaleImageYuXu in Splash.c

Summary: VUL-1: CVE-2019-10024: xpdf: floating point exception in function Splash:scal...

Status:	RESOLVED INVALID

Alias:	CVE-2019-10024

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assignee:	Peter Simons
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/226992/
Whiteboard:	CVSSv3:SUSE:CVE-2019-10024:3.3:(AV:L/...
Keywords:

Depends on:
Blocks:	1133493
	Show dependency tree / graph

Clone This Bug

Reported:	2019-03-29 12:45 UTC by Robert Frohl
Modified:	2023-06-14 14:35 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
QA Reproducer (3.50 KB, application/gzip) 2019-03-29 12:47 UTC, Robert Frohl	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2019-03-29 12:45:44 UTC

rh#1693627

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters.

Reference:
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1693627
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10024
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10024.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10024
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274

Comment 1 Robert Frohl 2019-03-29 12:47:14 UTC

Created attachment 801686 [details]
QA Reproducer

$ pdftoppm Splash::scaleImageYuXu@Splash.cc:5556-21___FPE out.ppm

Comment 2 Robert Frohl 2019-03-29 12:47:34 UTC

tracking as affected:
- SUSE:SLE-10-SP3:Update
- SUSE:SLE-11:Update

Comment 3 Petr Gajdos 2023-06-08 09:59:57 UTC

Not reproducible for 11sp1/poppler not newer ones. xpdf is out of support, hence I propose to close this bug.