CVE-2017-2820

Published: 07 July 2017

An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library.

Priority

Medium

CVSS 3 base score: 8.8

Status

Package Release Status
poppler
Launchpad, Ubuntu, Debian 		Upstream Needs triage

Ubuntu 16.04 ESM (Xenial Xerus)
Released (0.41.0-0ubuntu1.2)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [0.24.5-2ubuntu4.5])

Notes

AuthorNote
mdeslaur 
contrary to Debian, Ubuntu uses the internal JPEG 2000 library
as openjpeg has not been approved for main inclusion

References

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading