CVE-2018-5679

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

CVE-2018-5675

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

UBUNTU-CVE-2018-11254

An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file, a related issue to CVE-2017-8054...

chromium-browser: Use after free in PDFium

An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file...

Foxit Reader and PhantomPDF Heap Buffer Overflow Vulnerability

Foxit Reader is a PDF document reader from China's Foxit Software Corporation.Foxit PhantomPDF is a commercial version. A heap buffer overflow vulnerability exists in Foxit Reader and PhantomPDF versions 7.3.4.311 and earlier. A remote attacker could exploit this vulnerability with Bezier data in...

CVE-2017-17858

Heap-based buffer overflow in the ensuresolidxref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted...

DEBIAN-CVE-2018-5308

PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function base/PdfOutputStream.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file...

PT-2018-16885 · Podofo +4 · Podofo +4

Name of the Vulnerable Software and Affected Versions: PoDoFo version 0.9.5 Description: The issue arises from improper validation of memcpy arguments in the PdfMemoryOutputStream::Write function. This could allow remote attackers to cause a denial-of-service or possibly other unspecified impacts...

CVE-2017-16368

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability leads to a stack-based buffer overflow condition in the internal Unicode string...

chromium-browser: use after free in pdfium

Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file...

iText XML External Entity Vulnerability

iText is a software development kit that allows users to integrate PDF functionality into their application, process or product. An XML external entity injection vulnerability exists in iText prior to 5.5.12 and version 7.x prior to 7.0.3. The vulnerability arises because the XML parser in iText...

Poppler Denial of Service Vulnerability (CNVD-2017-32544)

Poppler is a C++ class library for generating PDF, the library is inherited from Xpdf PDF reader. A denial of service vulnerability exists in the 'GfxImageColorMap::getGrayLine' function of the GfxState.cc file in Poppler version 0.59.0. A remote attacker can exploit this vulnerability with a...

USN-3350-1 poppler vulnerabilities

Aleksandar Nikolic discovered that poppler incorrectly handled JPEG 2000 images. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. CVE-2017-28...

CVE-2017-8460

Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows information disclosure when a user opens a specially crafted PDF file, aka "Windows PDF Information Disclosure Vulnerability"...

ALPINE-CVE-2017-9208

libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service infinite recursion and stack consumption via a crafted PDF document, related to releaseResolved functions, aka qpdf-infiniteloop1...

DEBIAN-CVE-2017-7382

The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted PDF document...

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file...

PT-2017-4246

Name of the Vulnerable Software and Affected Versions PyPDF2 versions prior to 1.27.5 Description The issue is related to the ContentStream. readInlineImage function in the PyPDF2 library, which can lead to an infinite loop if an attacker crafts a PDF that causes the code to attempt to get the...

CVE-2016-5220

PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file...

CVE-2016-5184

PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFLFormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files...