The vulnerability of the AnnotRichMedia::Configuration::Configuration function in the Annot.cc component of the PDF rendering library Poppler, related to the assignment of a null pointer, allows a malicious actor to trigger a service failure.

The vulnerability of the AnnotRichMedia::Configuration::Configuration function in the Annot.cc component of the PDF rendering library allows an attacker to trigger a service failure using a specially created PDF document. This vulnerability involves the use of a null pointer dereferencing...

MuPDF: Multiple vulnerabilities

Background MuPDF is a lightweight PDF viewer and toolkit written in portable C. Description Multiple vulnerabilities have been discovered in MuPDF. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted PDF document...

Design/Logic Flaw

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a...

Foxit Reader 缓冲区错误漏洞

Foxit Reader is a PDF document reader from the Chinese company Foxit. Foxit Reader 10.1.1.37576 suffers from a buffer error vulnerability that stems from a lack of proper validation of user-supplied data, resulting in reading more than the end of an allocated object. An attacker can exploit this...

EulerOS 2.0 SP3 : qpdf (EulerOS-SA-2021-1843)

According to the versions of the qpdf package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service infinite recursion and stack consumption via a crafted PDF document,...

EulerOS 2.0 SP3 : compat-poppler022 (EulerOS-SA-2021-1772)

According to the version of the compat-poppler022 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to...

SUSE: Security Advisory (SUSE-SU-2017:2952-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Description of the security update for SharePoint Enterprise Server 2016: April 13, 2021 (KB4504719)

None None...

Reportlab Server-Side Request Forgery Vulnerability

ReportLab is a Danish ReportLab company for the creation of data-driven PDF documents and custom vector graphics open source engine . A security vulnerability exists in Reportlab. The vulnerability stems from a server-side request forgery vulnerability that can be triggered by img tags. Currently...

Exploit for Out-of-bounds Write in Adobe Acrobat

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bu...

EulerOS 2.0 SP3 : poppler (EulerOS-SA-2021-1112)

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by...

Foxit Reader and PhantomPDF Competitive Conditions Vulnerability (CNVD-2021-04401)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit Reader and PhantomPDF, which can be exploited by attackers to cause a stack buffer overflow or an out-of-bounds read...

[ASA-202101-3] poppler: arbitrary code execution

Arch Linux Security Advisory ASA-202101-3 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-35702 Package : poppler Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1382 Summary ======= The package poppler before...

Code injection

An issue was discovered in Foxit Reader before 10.1.1 and before 4.1.1 on macOS and PhantomPDF before 9.7.5 and 10.x before 10.1.1 and before 4.1.1 on macOS. An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subty...

CVE-2020-35702

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a...

CVE-2020-35702

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a...

Heap overflow

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a...

CVE-2020-35702

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a...

CVE-2020-13570

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger the reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicio...

Foxit Reader JavaScript media openPlayer type confusion vulnerability

Summary A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger an improper use of an object, resulting in memory corruption and arbitrary code execution. An attacker needs to trick the...