EUVD-2024-0159

Malicious code in bioql PyPI...

EUVD-2022-40939

Malicious code in bioql PyPI...

EulerOS 2.0 SP10 : ghostscript (EulerOS-SA-2025-2064)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF...

CVE-2025-50420

The pdfseparate utility in freedesktop poppler versions prior to 25.07.0 is vulnerable to an infinite recursion issue. The root cause lies in the PDFDoc processing logic where "/Annots" dictionaries that reference themselves or each other trigger a recursive loop in the sequence markAnnotations -...

CVE-2025-50422

CVE-2025-50422 affects Cairo (up to 1.18.4) as used in Poppler (up to 25.08.0). The issue is an assertion failure (unscaled->face == NULL) in _cairo_ft_unscaled_font_fini within cairo-ft-font.c, leading to a crash in affected workflows. Mitigations from connected advisories: update Cairo/Poppl...

CVE-2025-48708

gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext...

Arbitrary JavaScript execution due to using outdated libraries

Summary gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution. PoC 1. Generate a pdf file with a malicious script in the fontmatrix. This will run alert‘XSS’. poc.pdf 2. Run the app. In this PoC, I've used the demo...

Kofax Power PDF 安全漏洞

Kofax Power PDF is a professional PDF editing and management software from Kofax. A security vulnerability exists in Kofax Power PDF, which stems from a U3D File Parsing out-of-bounds read remote code execution vulnerability...

CVE-2023-2662

In Xpdf 4.04 and earlier, a bad color space object in the input PDF file can cause a divide-by-zero...

ALSA-2023:2259 Moderate: poppler security and bug fix update

Poppler is a Portable Document Format PDF rendering library, used by applications such as Evince. Security Fixes: poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Get integrated Microsoft Purview Information Protection in Adobe Acrobat—now available

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Data security and compliance are a top priority for leaders as cyberattacks are on the rise. In fact, attacks have increased by 32 percent in the past year, and 1 in 40 organizations...

Get integrated Microsoft Purview Information Protection in Adobe Acrobat—now available

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Data security and compliance are a top priority for leaders as cyberattacks are on the rise. In fact, attacks have increased by 32 percent in the past year, and 1 in 40 organizations...

Embed PDF <= 1.0.6 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks gdoc class='"...

CVE-2022-3160

The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process...

OSV-2022-655 UNKNOWN WRITE in pdfi_repair_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49606 Crash type: UNKNOWN WRITE Crash state: pdfirepairfile pdfireadxrefstreamdict pdfireadxref...

Google Chrome PDF Security Feature Issue Vulnerability

Google Chrome is a web browser from Google, an American company. A security signature issue vulnerability exists in versions of Google Chrome prior to 102.0.5005.61, which stems from a faulty implementation of PDF. An attacker could exploit the vulnerability to gain access to sensitive informatio...

CVE-2022-27337

CVE-2022-27337 describes a logic error in Poppler (v22.03.0) within the Hints::Hints function that can cause a Denial of Service when parsing a crafted PDF. The issue is a vulnerability in the PDF rendering library’s handling, not a user-triggered component, with the DoS impact noted in the publi...

CVE-2021-34847

CVE-2021-34847 affects Foxit PDF Reader (11.0.0.49893). The flaw is in handling Annotation objects: the code fails to validate the existence of an object before operating on it, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a malicious pag...

poppler:pdf_draw_fuzzer: Heap-buffer-overflow in Decrypt::makeFileKey2

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=5599864430919680 Project: poppler Fuzzing Engine: honggfuzz Fuzz Target:...

Falsifying and weaponizing certified PDFs

The Portable Document Format PDF file type is one of the most common file formats in use today. Its value comes from the fact that PDFs always print the same way, and that PDFs are supposed to be read-only unlike a Word document, say, which is designed to be easy to edit. This immutability can be...