DeutschShown in its original language — a full translation is planned for a future version.
xpdf: Mehrere Schwachstellen
view advisory published 2019-07-04
Ein Angreifer kann mehrere Schwachstellen in xpdf ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder sonstige Angriffe mit unbekannten Auswirkungen durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-13291US | medium5.5 | — | ||
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sending a crafted PDF docum… | ||||
| CVE-2019-13289US | high7.8 | — | ||
In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF… | ||||
| CVE-2019-13288US | medium5.5 | Exploit | ||
In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar t… | ||||
| CVE-2019-13287US | medium5.5 | — | ||
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sen… | ||||
| CVE-2019-13286US | medium5.5 | — | ||
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can, for example, be triggered by sending a c… | ||||
| CVE-2019-13283US | high7.8 | — | ||
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid len… | ||||
| CVE-2019-13282US | high7.8 | — | ||
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can, for example, be trigger… | ||||
| CVE-2019-13281US | high7.8 | — | ||
In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example, be triggered by send… | ||||
02
references
External citations — patches, advisories, analysis.
- SUSE Security Update SUSE-SU-2023:0496-1 vom 2023-02-23external
- SUSE Security Update SUSE-SU-2023:0494-1 vom 2023-02-23external
- National Vulnerability Database CVE-2019-13281 vom 2019-07-04external
- National Vulnerability Database CVE-2019-13282 vom 2019-07-04external
- National Vulnerability Database CVE-2019-13283 vom 2019-07-04external
- National Vulnerability Database CVE-2019-13286 vom 2019-07-04external
- National Vulnerability Database CVE-2019-13287 vom 2019-07-04external
- National Vulnerability Database CVE-2019-13288 vom 2019-07-04external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan