CVE-2019-10872

Name of the Vulnerable Software and Affected Versions Poppler version 0.74.0

Description The issue is related to a heap-based buffer over-read in the Splash::blitTransparent function at splash/Splash.cc. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The Splash::blitTransparent function is used for rendering PDF files and the over-read occurs when reading beyond the valid boundaries of a data buffer.

Recommendations For Poppler version 0.74.0, consider disabling the Splash::blitTransparent function as a temporary workaround until a patch is available. Restrict access to the splash/Splash.cc module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.