CVE-2020-35702

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document

published December 25, 2020

CVSS
—
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00871 · 58.4th percentile
Published
2020-12-25T01:02Z
EPSS history
Timeline
  • 25 DEC 01:02Z
    DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document
    cvelistv5