CVE-2017-18267

Public on 2018-05-10

Modified on 2019-05-30

Description

The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.

Severity

Low

See what this means

CVSS v3 Base Score

5.1

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 1	poppler	2018-12-06 00:26	ALAS-2018-1110
Amazon Linux 2 - Core	poppler	2019-05-29 19:06	ALAS2-2019-1217

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	5.1	CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
NVD	CVSSv3	5.5	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Red Hat: CVE-2017-18267 Mitre: CVE-2017-18267 FAQs regarding Amazon Linux ALAS/CVE Severity