CVE-2023-34872 : A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attac

A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

Published 2023-07-31 14:15:10

Updated 2023-12-06 03:15:07

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-34872

Freedesktop » Poppler
Versions before (<) 23.06.0
cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-34872

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-34872

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2023-34872

https://gitlab.freedesktop.org/poppler/poppler/-/commit/591235c8b6c65a2eee88991b9ae73490fd9afdfe

OutlineItem::open: Fix crash on malformed files (591235c8) · Commits · poppler / poppler · GitLab
Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFBT75QHBWNMSDAHSXZQ2I3PBJWID36K/

[SECURITY] Fedora 39 Update: mingw-poppler-23.02.0-4.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XXL3L6RJOTLGCN7GLH2OLLNF4FJ4T7I/

[SECURITY] Fedora 37 Update: poppler-22.08.0-5.fc37 - package-announce - Fedora Mailing-Lists
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1399

crash in pdftohtml (#1399) · Issues · poppler / poppler · GitLab
Exploit;Issue Tracking;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ3NYJ43U2MA7COKGMJDARZUAAOP45D4/

[SECURITY] Fedora 38 Update: poppler-23.02.0-3.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3H3GOWFE3C7543GMEN7LY4GWMWJ7D2G/

[SECURITY] Fedora 38 Update: mingw-poppler-23.02.0-2.fc38 - package-announce - Fedora Mailing-Lists

Jump to

Vulnerability Details : CVE-2023-34872

Products affected by CVE-2023-34872

Exploit prediction scoring system (EPSS) score for CVE-2023-34872

CVSS scores for CVE-2023-34872

References for CVE-2023-34872