PT-2018-14468 · Xpdf+2 · Xpdf+2
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xpdf version 4.00
Description
The issue allows remote attackers to cause a denial of service, specifically a heap-based buffer over-read, via a crafted pdf file. This is demonstrated by the use of pdftoppm, which exploits the
CCITTFaxStream::readRow() function in Stream.cc.Recommendations
For Xpdf version 4.00, consider disabling the
CCITTFaxStream::readRow() function in Stream.cc as a temporary workaround until a patch is available. Restrict access to handling crafted pdf files to minimize the risk of exploitation.Exploit
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Suse
Xpdf