37 matches found
CVE-2026-82035
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...
DEBIAN-CVE-2026-82035
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...
CVE-2026-82035
A flaw was found in PyMuPDF. This path traversal vulnerability exists in the extractobjects function, specifically within the font branch. A remote attacker can exploit this by providing a specially crafted PDF, EPUB, XPS, or FB2 file. The vulnerability allows the attacker to use encoded path...
EUVD-2026-77764
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...
CVE-2026-82035
PyMuPDF versions through 1.28.2 contain a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py. The root cause is that a document-controlled BaseFont name is joined directly onto the user-supplied output directory without stripping path separators or dot-dot seq...
CVE-2026-82035 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...
CVE-2026-82035 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...
CVE-2026-82035 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...
Linux Distros Unpatched Vulnerability : CVE-2026-82035
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output...
PT-2026-91398
Name of the Vulnerable Software and Affected Versions PyMuPDF versions prior to 1.28.3 Description A path traversal issue exists in the extract objects function within src/ main .py. The software constructs output filenames by joining a document-controlled BaseFont name to a user-supplied output...
Unity Linux 20.1070e Security Update: ghostscript (UTSA-2026-099516)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099516 advisory. Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc. Tenable has...
EUVD-2024-26511
Malicious code in bioql PyPI...
USN-6897-1 ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly handled certain long PDF filter names. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2024-29506 It was discovered that...
CVE-2024-29508
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...
CVE-2024-29508
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...
UBUNTU-CVE-2024-29508
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...
CVE-2024-29508
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...
CVE-2024-29508: Heap-based Buffer Overflow
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...