Lucene search

GandCCVELIST:CVE-2023-2664

HistoryMay 11, 2023 - 8:21 p.m.

CVE-2023-2664 Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file tree

2023-05-1120:21:25

CWE-674

GandC

www.cve.org

xpdf 4.04

stack overflow

pdf object loop

embedded file tree

infinite recursion

CVSS3

2.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.9

Confidence

High

EPSS

Percentile

12.7%

JSON

In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "all"
    ],
    "product": "Xpdf",
    "vendor": "Xpdf",
    "versions": [
      {
        "status": "affected",
        "version": "4.04"
      }
    ]
  }
]

References

forum.xpdfreader.com/viewtopic.php?t=42422

CVSS3

2.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.9

Confidence

High

EPSS

Percentile

12.7%

JSON

Related for CVELIST:CVE-2023-2664