Vulnerability Spotlight: TALOS-2017-0311,0319,0321 - Multiple Remote Code Execution Vulnerability in Poppler PDF library
Summary: Cisco Talos discovered three remote code execution vulnerabilities in the Poppler PDF library version 0.53.0: a heap overflow in DCTStream::readScan() (CVE-2017-2814), a heap overflow in DCTStream::readProgressiveSOF() (CVE-2017-2818) that repeats a bug previously fixed in readBaselineSOF, and an integer overflow in JPEG 2000 image parsing (CVE-2017-2820). Each is triggered when a victim opens a crafted PDF in an application using the library, such as Evince shipped with the latest Ubuntu Linux, and can execute code with the local user's rights.
Bottom line: The vulnerable code sits in a shared library embedded across enterprise and open source applications, so patching the operating system alone leaves the exposure in place - and Talos reports seeing client-side attacks based on malicious PDF files daily.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2005-3627CVE-2017-2814CVE-2017-2818CVE-2017-2820
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026