CVE-2013-4472
LowSummary
The openTempFile function in Xpdf and Poppler 0.24.3 and earlier creates temporary files with predictable names when running on non-Unix systems. A local user can exploit a symlink attack to overwrite arbitrary files.
Risk Assessment
A local attacker could overwrite system or configuration files with the privileges of the PDF-processing process, potentially leading to privilege escalation or system corruption.
Recommendation
Upgrade Xpdf/Poppler beyond 0.24.3 or apply the vendor fix; also restrict PDF conversion on non-Unix systems.
Other vulnerabilities in Poppler
See all- CVE-2017-15565High
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
- CVE-2017-14977High
The FoFiTrueType::getCFFBlock function in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.
- CVE-2017-14976High
The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a heap-based buffer over-read vulnerability when encountering an out-of-bounds font dictionary index. This can be exploited by an attacker to launch a denial of service attack.
- CVE-2017-14975High
The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initialized, allowing an attacker to launch a denial of service attack.
- CVE-2017-14929High
In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill, and Gfx::drawForm calls. This is a different vulnerability than CVE-2017-14519.
- CVE-2017-14617High
In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.
- CVE-2017-14520High
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files.
- CVE-2017-14519High
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- CVE-2017-14518High
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.
- CVE-2017-2820High
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of Poppler 0.53.0. Opening a specially crafted PDF file can lead to an overflow, resulting in out of bounds memory overwrite on the heap and potential arbitrary code execution.
Original NVD description (English source)
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS