logo
DATABASE RESOURCES PRICING ABOUT US

CVE-2019-13283

Description

In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.


Affected Package


OS OS Version Package Name Package Version
Debian 12 xpdf 3.04+git20220601-1
Debian 11 xpdf 3.04+git20210103-3
Debian 10 xpdf 3.04-13
Debian 999 xpdf 3.04+git20220601-1

Related