Bug 1143570 (CVE-2019-14292) - VUL-1: CVE-2019-14292: xpdf, poppler: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading:parse at GfxState.cc for typeA!=6 case 1.
Summary: VUL-1: CVE-2019-14292: xpdf, poppler: An issue was discovered in Xpdf 4.01.01...
Status: RESOLVED FIXED
Alias: CVE-2019-14292
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/238123/
Whiteboard: CVSSv3:SUSE:CVE-2019-14292:3.3:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-31 08:35 UTC by Wolfgang Frisch
Modified: 2024-05-06 12:58 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Wolfgang Frisch 2019-07-31 12:33:38 UTC 
xpdf is supported in: SUSE:SLE-11:Update.

SUSE:SLE-11:Update: xpdf-3.02: 
Not affected. Verified with PoC exploit.
Comment 2 Wolfgang Frisch 2019-07-31 12:49:00 UTC 
poppler, a fork of xpdf, is vulnerable in:

Repository     : SLES12-SP3-Updates
Name           : poppler-tools
Version        : 0.43.0-16.15.1

>pdftoppm pdftoppm/poc/GfxPatchMeshShading::parse@GfxState.cc:3269-13___SEGV_UNKNOW /dev/null
>Aborted                 (core dumped)
Comment 3 Petr Gajdos 2023-06-20 17:38:26 UTC 
The crash reproduced with 12sp2,12/poppler:

:/143570 # pdftoppm pdftoppm/poc/GfxPatchMeshShading::parse@GfxState.cc:3269-13___SEGV_UNKNOW /dev/null
Syntax Error (38): Dictionary key must be a name object
Syntax Error (46): Dictionary key must be a name object
[..]
Syntax Error (1046): Dictionary key must be a name object
Syntax Error (1054): Bad 'Length' attribute in stream
Syntax Error (2108): Missing 'endstream' or incorrect stream length
Internal Error (0): Call to Object where the object was type 10, not the expected type 1, 14 or 2
Aborted (core dumped)
:/143570 #
Comment 4 Petr Gajdos 2023-06-20 17:38:46 UTC 
(not with 15+/poppler)
Comment 5 Petr Gajdos 2023-06-20 18:01:07 UTC 
Patch unknown
Comment 6 Petr Gajdos 2023-10-10 13:25:37 UTC 
BEFORE

12sp2,12/poppler

:/143570/pdftoppm/poc # pdftoppm GfxPatchMeshShading::parse@GfxState.cc:3269-13___SEGV_UNKNOW /dev/null
Syntax Error (38): Dictionary key must be a name object
Syntax Error (46): Dictionary key must be a name object
Syntax Error (3797): Dictionary key must be a name object
Syntax Error (3798): Dictionary key must be a name object
[..]
Syntax Error (1046): Dictionary key must be a name object
Syntax Error (1054): Bad 'Length' attribute in stream
Syntax Error: Invalid XRef entry
Syntax Error (2108): Missing 'endstream' or incorrect stream length
Internal Error (0): Call to Object where the object was type 10, not the expected type 1, 14 or 2
Aborted (core dumped)
:/143570/pdftoppm/poc #


PATCH

https://gitlab.freedesktop.org/poppler/poppler/-/commit/aa03a71c3a1127cffd19bb0f596c4b361a7f2269


AFTER

12sp2,12/poppler

:/143570/pdftoppm/poc # pdftoppm GfxPatchMeshShading::parse@GfxState.cc:3269-13___SEGV_UNKNOW /dev/null
Syntax Error (38): Dictionary key must be a name object
Syntax Error (46): Dictionary key must be a name object
Syntax Error (3797): Dictionary key must be a name object
Syntax Error (3798): Dictionary key must be a name object
[..]
Syntax Error (1046): Dictionary key must be a name object
Syntax Error (1054): Bad 'Length' attribute in stream
Syntax Error: Invalid XRef entry
Syntax Error (2108): Missing 'endstream' or incorrect stream length
Syntax Warning: Missing or invalid Decode array in shading dictionary  <-------
Syntax Error (2413): Illegal character '>'
[..]
Syntax Error: Kid object (page 4) is not an indirect reference (name)
Syntax Error: Kid object (page 4) is not an indirect reference (name)
Syntax Error: Kid object (page 4) is not an indirect reference (name)
Syntax Error: Kid object (page 4) is not an indirect reference (name)
:/143570/pdftoppm/poc #
Comment 7 Petr Gajdos 2023-10-10 13:29:05 UTC 
Will submit for 12sp2,12/poppler.
Comment 8 Petr Gajdos 2023-10-17 12:10:42 UTC 
Packages submitted.

I believe all fixed.
Comment 13 Maintenance Automation 2023-11-03 16:30:06 UTC 
SUSE-SU-2023:4362-1: An update that solves nine vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1112424, 1112428, 1128114, 1129202, 1140745, 1143570, 1214256, 1214723, 1214726
CVE References: CVE-2018-18454, CVE-2018-18456, CVE-2019-13287, CVE-2019-14292, CVE-2019-9545, CVE-2019-9631, CVE-2020-36023, CVE-2022-37052, CVE-2022-48545
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1
SUSE Linux Enterprise Server 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Maintenance Automation 2023-11-24 12:30:21 UTC 
SUSE-SU-2023:4546-1: An update that solves six vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1128114, 1129202, 1143570, 1214256, 1214723, 1214726
CVE References: CVE-2019-14292, CVE-2019-9545, CVE-2019-9631, CVE-2020-36023, CVE-2022-37052, CVE-2022-48545
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): poppler-0.24.4-14.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Thomas Leroy 2024-05-06 12:58:21 UTC 
All done, closing.