Christian Mainka

يسمح البرنامج بتزوير التوقيع من خلال استخدام مجموعات المحتوى الاختياري (OCG). عندما تكون مجموعات المحتوى الاختياري (OCG) مدعومة، فإن خاصية حالة مجموعة المحتوى الاختياري تكون سارية فقط في وقت التشغيل ولا يتم تضمينها في حساب التوقيع الرقمي. يمكن للمهاجم استخدام JavaScript أو مشغلات PDF لتغيير رؤية محتوى OCG بعد التوقيع، مما يؤدي إلى تعديل المحتوى المرئي لملف PDF الموقع دون إبطال صحة التوقيع. وقد يؤدي ذلك إلى وجود تباين بين المحتوى الموقع والمحتوى المعروض للموقع أو المدقق، مما قد يضر بمصداقية التوقيع الرقمي.

يمكن لمستند PDF مصمم خصيصًا استخدام JavaScript لتعديل محتوى التعليقات التوضيحية، ثم إزالة حالة التعديل من الملف عبر واجهات JavaScript. يؤدي ذلك إلى التحايل على التحقق من التوقيع الرقمي عن طريق إخفاء التغييرات في المستند، مما قد يخدع المستخدمين بشأن سلامة المستند ويقوض الثقة المرتبطة بملفات PDF الموقعة.

The issue is related to errors in the representation of information by the user interface in Microsoft Office. It allows a remote attacker to conduct spoofing attacks.

The issue is related to errors in cryptographic signature verification, allowing a remote attacker to modify the content of an ODF document. It is possible for an attacker to manipulate documents to appear to be signed by a trusted source.

The issue is related to errors in cryptographic signature verification, allowing an attacker to manipulate signed documents and macros to appear as if they come from a trusted source.

The issue is related to errors in checking signed documents, which can be exploited by a remote attacker to compromise the integrity of information. It is possible for an attacker to manipulate the timestamp of signed documents.

The issue affects client implementations using the Python oic library, a Python OpenID Connect implementation. There are several related cryptographic issues: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) `oic.consumer.Consumer.parse authz` returns an unverified IdToken, with verification left to the implementator's discretion. 4) The `iat` claim was not checked for sanity, allowing it to be in the future.

An issue existed in the handling of links in encrypted PDFs, which could allow an attacker to exfiltrate the contents of an encrypted PDF. This issue was addressed by adding a confirmation prompt.

The issue allows remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages, due to improper information leakage about decryption failures when decrypting an encrypted key or message data.

The issue allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers. This is demonstrated by providers such as Verisign, LiveJournal, and StackExchange.

The issue allows remote attackers to bypass the `requireSignedEncryptedDataElements` configuration through vectors related to "wrapping attacks". This enables attackers to evade security measures.

The issue allows remote attackers to cause a denial of service, consuming CPU and memory, via crafted XML with a large number of elements, attributes, nested constructs, and possibly other vectors.