CVE-2020-35702

{"id": "CVE-2020-35702", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-12-25T02:15:12.900", "references": [{"url": "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects"}, {"lang": "es", "value": "** EN DISPUTA ** La funci\u00f3n DCTStream::getChars en el archivo DCTStream.cc en Poppler versi\u00f3n 20.12.1, presenta un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria por medio de un documento PDF dise\u00f1ado. NOTA: informes posteriores indican que esto s\u00f3lo afecta a las construcciones de los clones de git de Poppler a finales de diciembre de 2020, no a la versi\u00f3n 20.12.1. En esta situaci\u00f3n, NO debe considerarse una vulnerabilidad del Poppler. Sin embargo, varios proyectos de c\u00f3digo abierto de terceros dependen directamente de clones de git Poppler hechos en momentos arbitrarios, y por lo tanto el CVE sigue siendo \u00fatil para los usuarios de esos proyectos"}], "lastModified": "2024-11-21T05:27:52.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freedesktop:poppler:20.12.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED965244-90F8-4284-A3E5-009B0154501F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}