FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-2950

This CVE name corresponds to:

Entered	Topic
2008-07-09	poppler -- uninitialized pointer

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-2950 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-2950
Phase	Assigned(20080630)

Description

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

References

Source	Reference
BUGTRAQ	20080707 [oCERT-2008-007] libpoppler uninitialized pointer
MILW0RM	6032
MISC	http://www.ocert.org/advisories/ocert-2008-007.html
GENTOO	GLSA-200807-04
MANDRIVA	MDVSA-2008:146
SUSE	SUSE-SR:2008:015
BID	30107
FRSIRT	ADV-2008-2024
SECTRACK	1020435
SECUNIA	30963
SECUNIA	31002
XF	poppler-page-destructor-code-execution(43619)