huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Off-by-one error in prefix calculation in the mboxlist_do_find function
CVE: CVE-2017-14230
Component: cyrus-imapd
CWE: CWE-193
Severity: Moderate
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2017-08-31T00:00:00+00:00

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.


Remediation:
CVE: CVE-2017-1000068
Component: CVE-2017-1000068
Release date: 2017-07-13T00:00:00+00:00

TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability to disable arbitrary running splits and cause denial of service to clients in the field.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Automatic sec context deletion could lead to double-free
CVE: CVE-2017-11462
Component: krb5
CWE: CWE-416
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2017-08-28T00:00:00+00:00

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.


Remediation:
CVE: CVE-2017-1000438
Component: CVE-2017-1000438
Release date: 2017-01-01T00:00:00+00:00

In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem, then manipulate the user's data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Integer Overflow in the animation playing functionality
CVE: CVE-2017-2907
Component: blender
CVSS v3: 6.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2017-01-01T00:00:00+00:00

An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory leak in the ReadDPXImage function in coders/dpx.c
CVE: CVE-2017-11527
Component: ImageMagick
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-06-24T00:00:00+00:00

The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


Remediation:
Multiple security issues
CVE: CVE-2017-0890
Component: nextcloud
Release date: 2017-05-08T00:00:00+00:00

Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2017-1000087
Component: CVE-2017-1000087
Release date: 2017-10-03T00:00:00+00:00

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTTP request smuggling using the range header
CVE: CVE-2017-7656
Component: jetty
CWE: CWE-444
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2017-01-01T00:00:00+00:00

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

Statement: This issue affects the versions of jetty embedded in the nutch package as shipped with Red Hat Satellite 5. The nutch service is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Data Grid 7 has deprecated the agent-bond utility that permits this flaw; it is disabled by default and is no longer supported. While the functionality is still available for backward-compatibility usage, customers are strongly recommended to use Prometheus JMX instead. As the functionality is deprecated and no longer supported, the flaw has been scored as Moderate for Data Grid 7.

Data Grid 8 is not affected by this flaw.

Remediation:
To install this update, do the following:

1. Download the Data Grid 7.3.7 server patch from the customer portal. See the download link in the References section.
2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.
3. Install the Data Grid 7.3.7 server patch. Refer to the 7.3 Release Notes for patching instructions.
4. Restart Data Grid to ensure the changes take effect.
Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c
CVE: CVE-2017-15134
Component: 389-ds-base
CWE: CWE-120
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-01-01T00:00:00+00:00

A stack buffer overflow flaw was found in the way 389-ds-base handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the 389 server service will be restarted automatically.
Buffer over-read in the GfxImageColorMap::getGray function
CVE: CVE-2017-9865
Component: poppler
CWE: CWE-121
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-24T00:00:00+00:00

The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc.


Remediation:
net/rxrpc: overflow in decoding of krb5 principal
CVE: CVE-2017-7482
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.2/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2017-06-26T00:00:00+00:00

Keberos 5 tickets being decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6 and 7 as the module is not enabled on these systems.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise MRG-2.  Future Linux kernel updates for the respective releases may address this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
memory exhaustion in the function ReadTIFFImage in coders/tiff.c
CVE: CVE-2017-18028
Component: ImageMagick
CWE: CWE-400
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-09-07T00:00:00+00:00

In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a denial of service via a crafted file.


Remediation:
Missing check for integer overflow when handling chunk sizes in HTTP requests
CVE: CVE-2017-12425
Component: varnish
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2017-08-02T00:00:00+00:00

An integer overflow flaw, leading to assertion failure, was found in the way Varnish handled chunk sizes in HTTP requests. A remote attacker could use this flaw to make the Varnish daemon restart unexpectedly due to an assertion failure by sending a specially crafted HTTP request.


Remediation:
X-Forwarded-For header allows internal servers to deploy other systems (using callback)
CVE: CVE-2017-7528
Component: Tower
CWE: CWE-113
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Release date: 2017-01-01T00:00:00+00:00

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback).


Remediation:
Multiple security issues
CVE: CVE-2017-9166
Component: autotrace
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-05-20T00:00:00+00:00

libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:18:11.

Statement: Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
RCE via ssh URL with an initial dash character in the hostname
CVE: CVE-2017-12976
Component: git-annex
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-08-18T00:00:00+00:00

git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer over-read in print-isoclns.c:isis_print() in IS-IS parser
CVE: CVE-2017-12999
Component: tcpdump
CWE: CWE-125
Severity: Low
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2017-09-13T00:00:00+00:00

The IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print().


Remediation:
Incorrect Handling of CHOICE types in ASN.1 parser and x509 plugin
CVE: CVE-2017-9023
Component: strongswan
CWE: CWE-835
Severity: Moderate
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2017-05-30T00:00:00+00:00

The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Multiple security issues
CVE: CVE-2017-9189
Component: autotrace
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-05-20T00:00:00+00:00

libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and application crash), related to the GET_COLOR function in color.c:16:11.

Statement: Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Insufficient validation of shmseg resource id
CVE: CVE-2017-13721
Component: xorg-x11-server
CWE: CWE-20
Severity: Low
CVSS v3: 3.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2017-10-04T00:00:00+00:00

In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session.


Remediation:
Multiple vulnerabilities in 1.9.2 version
CVE: CVE-2017-9473
Component: ytnef
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-05-24T00:00:00+00:00

In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a crafted file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Integer signedness error
CVE: CVE-2017-8798
Component: miniupnpc
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-05-05T00:00:00+00:00

Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2017-1000195
Component: CVE-2017-1000195
Release date: 2017-01-01T00:00:00+00:00

October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory leak in the WritePCXImage function
CVE: CVE-2017-13058
Component: ImageMagick
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-08-10T00:00:00+00:00

In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allows attackers to cause a denial of service via a crafted file.


Remediation:
usb: an infinite loop issue in ohci_service_ed_list
CVE: CVE-2017-6505
Component: Qemu
CWE: CWE-835
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2017-02-07T00:00:00+00:00

The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.


Remediation:
CVE: CVE-2017-1002002
Component: CVE-2017-1002002
Release date: 2017-09-14T00:00:00+00:00

Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Signed integer overflow in tif_jpeg.c
CVE: CVE-2017-7601
Component: libtiff
CWE: CWE-190
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-09T00:00:00+00:00

LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


Remediation:
Buffer over-read in umodenc function
CVE: CVE-2017-11570
Component: fontforge
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-06-14T00:00:00+00:00

FontForge 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c) resulting in DoS or code execution via a crafted otf file.


Remediation:
Buffer overflow in the extract_icons function
CVE: CVE-2017-6010
Component: icoutils
CWE: CWE-122
Severity: Moderate
CVSS v3: 7.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Release date: 2017-02-03T00:00:00+00:00

A vulnerability was found in icoutils, in the icotool program. An attacker could create a crafted ICO or CUR file that, when read by icotool, could result in memory corruption leading to a crash or potential code execution.


Remediation:
Server: Optimizer unspecified vulnerability (CPU Jul 2017)
CVE: CVE-2017-3642
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-07-19T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Code injection when calling fetch() or display() on unsanitized template names
CVE: CVE-2017-1000480
Component: php-Smarty
CVSS v3: 7.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-07-21T00:00:00+00:00

Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory allocation error in parse_data_node
CVE: CVE-2017-6440
Component: libplist
CWE: CWE-190
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-02-24T00:00:00+00:00

The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.


Remediation:
Invalid free in the Action::TaskFactory::cleanup
CVE: CVE-2017-11337
Component: exiv2
CWE: CWE-416
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-07-13T00:00:00+00:00

There is an invalid free in the Action::TaskFactory::cleanup function of actions.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.


Remediation:
out of bounds read in zzip_mem_entry_new (memdisk.c)
CVE: CVE-2017-5978
Component: zziplib
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2017-02-09T00:00:00+00:00

The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.


Remediation:
Server: Security: Privileges unspecified vulnerability (CPU Apr 2017)
CVE: CVE-2017-3455
Component: mysql
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2017-04-19T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Multiple vulnerabilities fixed in 1.9.2 version
CVE: CVE-2017-9058
Component: ytnef
Release date: 2017-02-23T00:00:00+00:00

In libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory leak in the Object::initArray function
CVE: CVE-2017-9408
Component: poppler
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-24T00:00:00+00:00

In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.


Remediation: