Vulnerability · Published Dec 3, 2020 · Assigned by redhat
CVE-2020-27778
High 7.5
In plain English
A high-severity security flaw in poppler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.2%top 17.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | evince-devel | 3.28.4-11.el8 | ALSA-2021:1881 |
| AlmaLinux:8 | poppler-cpp | 20.11.0-2.el8 | ALSA-2021:1881 |
| AlmaLinux:8 | poppler-cpp-devel | 20.11.0-2.el8 | ALSA-2021:1881 |
| AlmaLinux:8 | poppler-devel | 20.11.0-2.el8 | ALSA-2021:1881 |
| AlmaLinux:8 | poppler-glib-devel | 20.11.0-2.el8 | ALSA-2021:1881 |
| AlmaLinux:8 | poppler-qt5 | 20.11.0-2.el8 | ALSA-2021:1881 |
| AlmaLinux:8 | poppler-qt5-devel | 20.11.0-2.el8 | ALSA-2021:1881 |
| Alpine:v3.20 | poppler | 0.76.0-r0 | ALPINE-CVE-2020-27778 |
| Alpine:v3.21 | poppler | 0.76.0-r0 | ALPINE-CVE-2020-27778 |
| Alpine:v3.22 | poppler | 0.76.0-r0 | ALPINE-CVE-2020-27778 |
| Alpine:v3.23 | poppler | 0.76.0-r0 | ALPINE-CVE-2020-27778 |
| Alpine:v3.24 | poppler | 0.76.0-r0 | ALPINE-CVE-2020-27778 |
| Debian:12 | poppler | 0.85.0-2 | DEBIAN-CVE-2020-27778 |
| Debian:13 | poppler | 0.85.0-2 | DEBIAN-CVE-2020-27778 |
| Debian:14 | poppler | 0.85.0-2 | DEBIAN-CVE-2020-27778 |
| Rocky Linux:8 | evince | 0:3.28.4-11.el8 | RLSA-2021:1881 |
| Rocky Linux:8 | poppler | 0:20.11.0-2.el8 | RLSA-2021:1881 |
Affected products (as reported)
Weakness: CWE-824
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1900712 x_refsource_MISC
- [debian-lts-announce] 20220925 [SECURITY] [DLA 3120-1] poppler security update mailing-list, x_refsource_MLIST