CVE-2017-14926、CVE-2017-14927、およびCVE-2017-14928のセキュリティ修正。

----

以下のためのセキュリティ修正 CVE-2017-14617

----

CVE-2017-14517、CVE-2017-14518、CVE-2017-14519およびCVE-2017-14929のセキュリティ修正。

----

  - CVE-2017-14520 Splash: : scaleImageYuXdの浮動小数点例外

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Poppler 0.74.0. There is a     heap-based buffer over-read in the function     PSOutputDev::checkPageSlice at     PSOutputDev.cc.(CVE-2019-10871)

  - In Poppler 0.59.0, a NULL Pointer Dereference exists in     the SplashOutputDev::type3D0() function in     SplashOutputDev.cc via a crafted PDF     document.(CVE-2017-14927)

  - PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0     mishandles dict marking, leading to stack consumption     in the function Dict::find() located at Dict.cc, which     can (for example) be triggered by passing a crafted pdf     file to the pdfunite binary.(CVE-2019-9903)

  - Poppler before 0.66.0 has an integer overflow in     Parser::makeStream in Parser.cc.(CVE-2018-21009)

  - The function GfxImageColorMap::getGray in GfxState.cc     in Poppler 0.54.0 allows remote attackers to cause a     denial of service (stack-based buffer over-read and     application crash) via a crafted PDF document, related     to missing color-map validation in     ImageOutputDev.cc.(CVE-2017-9865)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-14926, CVE-2017-14927 and CVE-2017-14928.

----

Security fix for CVE-2017-14617

----

Security fix for CVE-2017-14517, CVE-2017-14518, CVE-2017-14519 and CVE-2017-14929.

----

  - CVE-2017-14520 Floating point exception in     Splash::scaleImageYuXd

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Poppler 0.74.0 has a heap-based buffer over-read in the     CairoRescaleBox.cc downsample_row_box_filter     function.(CVE-2019-9631)

  - In Poppler through 0.76.1, there is a heap-based buffer     over-read in JPXStream::init in JPEG2000Stream.cc via     data with inconsistent heights or     widths.(CVE-2019-12293)

  - A stack-based buffer over-read exists in     FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in     Xpdf 4.01.01. It can, for example, be triggered by     sending crafted TrueType data in a PDF document to the     pdftops tool. It might allow an attacker to cause     Denial of Service or leak memory data into dump     content.(CVE-2019-12360)

  - Poppler before 0.66.0 has an integer overflow in     Parser::makeStream in Parser.cc.(CVE-2018-21009)

  - In Poppler 0.59.0, a NULL Pointer Dereference exists in     the SplashOutputDev::type3D0() function in     SplashOutputDev.cc via a crafted PDF     document.(CVE-2017-14927)

  - The function GfxImageColorMap::getGray in GfxState.cc     in Poppler 0.54.0 allows remote attackers to cause a     denial of service (stack-based buffer over-read and     application crash) via a crafted PDF document, related     to missing color-map validation in     ImageOutputDev.cc.(CVE-2017-9865)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 Poppler 0.59.0中，透過特製的 PDF 文件，在 SplashOutputDev.cc 的 SplashOutputDev::type3D0() 函式中存在一個 NULL 指標解除參照。 (CVE-2017-14927)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 Poppler 0.59.0中，SplashOutputDev.cc 的 SplashOutputDev::type3D0() 函数中存在通过特制的 PDF 文档导致的空指针取消引用。 (CVE-2017-14927)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

This update fixes the following security vulnerabilities :

  - CVE-2017-14517

  - CVE-2017-14518

  - CVE-2017-14519 

  - CVE-2017-14617

  - CVE-2017-14926

  - CVE-2017-14927

  - CVE-2017-14928

  - CVE-2017-14929

  - CVE-2017-14975 and CVE-2017-14976

  - CVE-2017-14977

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Resolves: rhbz#1505731 rebuild for qt5 5.9.2

----

Security fix for CVE-2017-14926, CVE-2017-14927 and CVE-2017-14928.

----

Security fix for CVE-2017-14617

----

Security fix for CVE-2017-14517, CVE-2017-14518, CVE-2017-14519 and CVE-2017-14929.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Poppler 0.59.0、細工された PDF ドキュメントを介して、SplashOutputDev.cc の SplashOutputDev::type3D0() 関数に NULL ポインターデリファレンスがあります。 （CVE-2017-14927）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

CVE-2017-14926、CVE-2017-14927、およびCVE-2017-14928のセキュリティ修正。

----

以下のためのセキュリティ修正 CVE-2017-14617

----

CVE-2017-14517、CVE-2017-14518、CVE-2017-14519およびCVE-2017-14929のセキュリティ修正。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in     SplashOutputDev.cc via a crafted PDF document. (CVE-2017-14927)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Poppler 0.54.0, a memory leak vulnerability was     found in the function gmalloc in gmem.cc, which allows     attackers to cause a denial of service via a crafted     file.(CVE-2017-9406)

  - In Poppler 0.54.0, a memory leak vulnerability was     found in the function Object::initArray in Object.cc,     which allows attackers to cause a denial of service via     a crafted file.(CVE-2017-9408)

  - The function GfxImageColorMap::getGray in GfxState.cc     in Poppler 0.54.0 allows remote attackers to cause a     denial of service (stack-based buffer over-read and     application crash) via a crafted PDF document, related     to missing color-map validation in     ImageOutputDev.cc.(CVE-2017-9865)

  - In Poppler 0.59.0, a NULL Pointer Dereference exists in     the SplashOutputDev::type3D0() function in     SplashOutputDev.cc via a crafted PDF     document.(CVE-2017-14927)

  - poppler 0.54.0, as used in Evince and other products,     has a NULL pointer dereference in the     JPXStream::readUByte function in JPXStream.cc. For     example, the perf_test utility will crash (segmentation     fault) when parsing an invalid PDF file.(CVE-2017-9083)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-14926, CVE-2017-14927 and CVE-2017-14928.

----

Security fix for CVE-2017-14617

----

Security fix for CVE-2017-14517, CVE-2017-14518, CVE-2017-14519 and CVE-2017-14929.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

この更新は、次のセキュリティの脆弱性を修正します：

  - CVE-2017-14517

  - CVE-2017-14518

  - CVE-2017-14519 

  - CVE-2017-14617

  - CVE-2017-14926

  - CVE-2017-14927

  - CVE-2017-14928

  - CVE-2017-14929

  - CVE-2017-14975とCVE-2017-14976

  - CVE-2017-14977

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

解決：rhbz#1505731 qt5のリビルド 5.9.2

----

CVE-2017-14926、CVE-2017-14927、およびCVE-2017-14928のセキュリティ修正。

----

以下のためのセキュリティ修正 CVE-2017-14617

----

CVE-2017-14517、CVE-2017-14518、CVE-2017-14519およびCVE-2017-14929のセキュリティ修正。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
104345	Fedora 25：poppler（2017-805d9423f8）	Nessus	Fedora Local Security Checks	2017/11/2	2021/1/6	high
149139	EulerOS 2.0 SP3 : poppler (EulerOS-SA-2021-1832)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/3	high
104345	Fedora 25 : poppler (2017-805d9423f8)	Nessus	Fedora Local Security Checks	2017/11/2	2021/1/6	high
146719	EulerOS 2.0 SP2 : poppler (EulerOS-SA-2021-1347)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/19	critical
220567	Linux Distros 未修補弱點：CVE-2017-14927	Nessus	Misc.	2025/3/4	2025/9/4	medium
220567	Linux Distros 未修补的漏洞: CVE-2017-14927	Nessus	Misc.	2025/3/4	2025/9/4	medium
104153	Fedora 25 : mingw-poppler (2017-6127ddb036)	Nessus	Fedora Local Security Checks	2017/10/26	2021/1/6	high
104155	Fedora 26 : mingw-poppler (2017-a0ffdf1fbd)	Nessus	Fedora Local Security Checks	2017/10/26	2021/1/6	high
104445	Fedora 26 : poppler (2017-51ff8fe326)	Nessus	Fedora Local Security Checks	2017/11/8	2021/1/6	high
220567	Linux Distros のパッチ未適用の脆弱性: CVE-2017-14927	Nessus	Misc.	2025/3/4	2025/9/4	medium
105805	Fedora 27：poppler（2017-025ff38ac9）	Nessus	Fedora Local Security Checks	2018/1/15	2025/11/6	high
220567	Linux Distros Unpatched Vulnerability : CVE-2017-14927	Nessus	Misc.	2025/3/4	2025/9/4	medium
146164	EulerOS 2.0 SP5 : poppler (EulerOS-SA-2021-1225)	Nessus	Huawei Local Security Checks	2021/2/4	2024/1/23	medium
105805	Fedora 27 : poppler (2017-025ff38ac9)	Nessus	Fedora Local Security Checks	2018/1/15	2025/11/6	high
104153	Fedora 25：mingw-poppler（2017-6127ddb036）	Nessus	Fedora Local Security Checks	2017/10/26	2021/1/6	high
104155	Fedora 26：mingw-poppler（2017-a0ffdf1fbd）	Nessus	Fedora Local Security Checks	2017/10/26	2021/1/6	high
104445	Fedora 26：poppler（2017-51ff8fe326）	Nessus	Fedora Local Security Checks	2017/11/8	2021/1/6	high

检测

插件搜索

high

high

high

critical

medium

medium

high

high

high

medium

high

medium

medium

high

high

high

high