CVE-2008-2950

Published: Jul 7, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Affected (1)

Products: Poppler: Poppler

Poppler

1 product

Poppler

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Poppler Poppler	Up to 0.8.4

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (40)

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html

Source: cve@mitre.org

http://secunia.com/advisories/30963

Source: cve@mitre.org

http://secunia.com/advisories/31002

Source: cve@mitre.org

http://secunia.com/advisories/31167

Source: cve@mitre.org

http://secunia.com/advisories/31267

Source: cve@mitre.org

http://secunia.com/advisories/31405

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200807-04.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/3977

Source: cve@mitre.org

http://wiki.rpath.com/Advisories:rPSA-2008-0223

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:146

Source: cve@mitre.org

http://www.ocert.org/advisories/ocert-2008-007.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/493980/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/494142/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/30107

Source: cve@mitre.org

http://www.securitytracker.com/id?1020435

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-631-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2024/references

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/43619

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6032

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00161.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html