Login Request a demo
High severity · published Jul 12, 2017
CVE-2017-2818
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0
8.8
CVSS
2%
EPSS
No
On KEV
Description
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption. An attacker controlled PDF file can be used to trigger this vulnerability.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Poppler · Freedesktop
0.53.0 · source: NVD
Affected product
PO
Poppler
Freedesktop
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2818
Third Party Advisory
http://www.securityfocus.com/bid/99497
Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0319
More from Poppler
7.8
CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability
9.8
CVE-2019-9631
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function
8.8
CVE-2018-21009
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc
8.8
CVE-2019-12293
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths
8.8
CVE-2019-10872
An issue was discovered in Poppler 0.74.0