Microsoft Windows EOT Font Engine Information Disclosure (CVE-2018-0760)

An information disclosure vulnerability has been reported in the EOT component of Microsoft Windows operating systems. The vulnerability is due to improper handling of objects in the Windows EOT Font Engine. A remote attacker could exploit this vulnerability by enticing a user to open specially...

DEBIAN-CVE-2018-8107

The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service heap-based buffer over-read and application crash via a specific pdf file, as demonstrated by pdftohtml...

DEBIAN-CVE-2018-8103

The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service heap-based buffer over-read and application crash via a specific pdf file, as demonstrated by pdftohtml...

PoDoFo 'UnescapeName()' function heap buffer out-of-bounds read vulnerability

PoDoFo is an open source , written in C++ using the PDF file format library . A heap buffer out-of-bounds read vulnerability exists in the 'UnescapeName' function of the PdfName.cpp file in PoDoFo version 0.9.5. A remote attacker can exploit this vulnerability with the help of a specially crafted...

UBUNTU-CVE-2018-1000074

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code...

chromium-browser: integer overflow in pdfium

An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read. In PoDoFo 0.9.5, there exists a heap-based buffer over-read vulnerability in UnescapeName in PdfName.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other...

Apache Oozie Information Disclosure Vulnerability (CNVD-2018-06533)

Apache Oozie is a workflow scheduling system for managing Apache Hadoop jobs from the U.S. Apache Apache Software Foundation. The system supports Java map-reduce, Pig, Hive and many other types of Hadoop jobs. A security vulnerability exists in Apache Oozie versions 3.1.3-incubating through 4.3.0...

Microsoft Windows EOT Font Engine Information Disclosure (CVE-2018-0761)

An information disclosure vulnerability has been reported in the EOT component of Microsoft Windows operating systems. The vulnerability is due to improper handling of objects in the Windows EOT Font Engine. A remote attacker could exploit this vulnerability by enticing a user to open specially...

DEBIAN-CVE-2018-7454

A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml...

Artifex Software MuPDF 'count_entries' function stack buffer overflow vulnerability

Artifex Software MuPDF is a PDF library from Artifex Software, USA. A security vulnerability exists in the 'countentries' function in the pdf-layer.c file in Artifex Software MuPDF version 1.10a. A remote attacker can exploit this vulnerability to cause a denial of service stack consumption and...

USN-3579-1 libreoffice vulnerability

It was discovered that =WEBSERVICE calls in a document could be used to read arbitrary files. If a user were tricked in to opening a specially crafted document, a remote attacker could exploit this to obtain sensitive information. CVE-2018-6871...

Microsoft Windows EOT Font Engine Information Disclosure (CVE-2018-0855)

An information disclosure vulnerability exists in the EOT component of Microsoft Windows operating systems. The vulnerability is due to improper handling of objects in the Windows EOT Font Engine. A remote attacker could exploit this vulnerability by enticing a user to open specially crafted...

Multiple Adobe products rendering engine memory misreference vulnerability

Acrobat DC Continuous Track and so on are the United States of America Ordoby Adobe company's products. Acrobat DC Continuous Track is a desktop version of the continuous update of the PDF solution. Reader DC Continuous Track is a continuous update of the PDF reading tool! The rendering engine is...

Artifex MuPDF Denial of Service Vulnerability (CNVD-2018-05478)

Artifex MuPDF is a free, lightweight PDF reader from Artifex Software. A security vulnerability exists in pdfloadobjstm in the pdf/pdf-xref.c file in Artifex MuPDF version 1.12.0. A remote attacker can exploit this vulnerability to cause a denial of service with a specially crafted PDF document...

Adobe Acrobat ImageConversion EMF Integer Overflow (CVE-2017-11308)

An integer overflow vulnerability exists in ImageConversion component of Adobe Acrobat. The vulnerability is due to improper parsing of EMF+ records in an EMF file, which leads to incorrect buffer allocation. A remote attacker could exploit this vulnerability by enticing a target user into openin...

Tracker PDF-XChange Viewer and Viewer AX SDK Command Execution Vulnerability

Tracker PDF-XChange Viewer is a Canadian Tracker Software company's set of PDF document production and viewing software. The software supports a variety of formats into PDF files, and its viewing, editing and annotation operations.Viewer AX SDK is a set of development tools used to add PDF docume...

DEBIAN-CVE-2014-3005

XML external entity XXE vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request...

UBUNTU-CVE-2014-3005

XML external entity XXE vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request...

CVE-2018-6462

Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document...