CVE-2017-1000456

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.freedesktop.org/show_bug.cgi?id=103116Exploit, Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00001.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4097Third Party Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=103116Exploit, Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00001.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4097Third Party Advisory

Timeline

Published: Jan 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10004574.8Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script o CVE-2017-10004589.8Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of ser CVE-2017-10004596.1Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes CVE-2017-10004606.5In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ign CVE-2017-10004614.7Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting b CVE-2017-10004625.4BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of serv CVE-2017-10004635.4Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in CVE-2017-10004655.4Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in d CVE-2017-10004665.4Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result i CVE-2017-10004675.4LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disrup CVE-2017-10004699.8Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execu CVE-2017-10004707.5EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of serv