CVE-2024-6239

Publication date 21 June 2024

Last updated 15 January 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.

Read the notes from the security team

Why is this CVE low priority?

Only a crash in the command line pdfinfo tool

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
poppler 24.10 oracular
Not affected
24.04 LTS noble
Fixed 24.02.0-1ubuntu9.1
23.10 mantic Ignored end of life, was needs-triage
22.04 LTS jammy
Fixed 22.02.0-2ubuntu0.5
20.04 LTS focal Ignored not feasible to fix
18.04 LTS bionic Ignored not feasible to fix
16.04 LTS xenial Ignored not feasible to fix

Notes

hlibk

For focal and lower, the upstream patch does not apply, and would likely require extra workaround. Older releases are no longer supported by upstream.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
poppler

Severity score breakdown

Parameter Value
Base score 7.5 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

Other references