CVE-2013-4474

Canonical Ubuntu Linux < 0.24.1 - Improper Input Validation

Title source: rule
STIX 2.1

Description

Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Daniel Kahn Gillmor · textlocallinux
https://www.exploit-db.com/exploits/38817

References (8)

Core 8
Core References
Issue Tracking x_refsource_confirm
http://bugs.debian.org/723124
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56567
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201401-21.xml
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/63374
Vendor Advisory x_refsource_confirm
https://bugs.freedesktop.org/show_bug.cgi?id=69434
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2958-1
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/10/29/1

Scores

EPSS 0.2540
EPSS Percentile 96.3%

Details

CWE
CWE-20
Status published
Products (50)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.10
freedesktop/poppler 0.1
freedesktop/poppler 0.1.1
freedesktop/poppler 0.1.2
freedesktop/poppler 0.2.0
freedesktop/poppler 0.3.0
freedesktop/poppler 0.3.1
freedesktop/poppler 0.3.2
... and 40 more
Published Nov 23, 2013
Tracked Since Feb 18, 2026