1331 matches found
Cross site scripting
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
CVE-2020-12646: Improper Neutralization of Input During Web Page Generation
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
EulerOS 2.0 SP8 : poppler (EulerOS-SA-2020-1875)
According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at...
Insecure Signature Validation
itextsharp does not properly verify the validity of the signature. It was possible to bypass the signature checker due to insufficient validation of PDF document...
Arbitrary Code Execution
okular is vulnerable to arbitrary code execution. An attacker is able to execute arbitrary code via an action link in a PDF document...
Updated podofo packages fix security vulnerability
The updated packages fix security vulnerabilities: A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file. CVE-2018-12983 An issue was...
Updated xpdf packages fix security vulnerability
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump...
CVE-2020-9816
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution...
New LNK attack tied to Higaisa APT discovered
This post was authored by Hossein Jazi and Jérôme Segura On May 29th, we identified an attack that we believe is part of a new campaign from an Advanced Persistent Threat actor known as Higaisa. The Higaisa APT is believed to be tied to the Korean peninsula, and was first disclosed by Tencent...
CVE-2020-6093
An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability, victim must open a malicious file...
CVE-2020-6093: Access of Uninitialized Pointer
An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause uninitialized memory access resulting in information disclosure. In order to trigger this vulnerability, victim must open a malicious file...
Debian DSA-4663-1 : python-reportlab - security update
It was discovered that python-reportlab, a Python library to create PDF documents, is prone to a code injection vulnerability while parsing a color attribute. An attacker can take advantage of this flaw to execute arbitrary code if a specially crafted document is processed. C Tenable Network...
CVE-2020-10904
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Foxit PhantomPDF U3DBrowser U3D File Parsing Heap Buffer Overflow Vulnerability
Foxit PhantomPDF is China's Foxit Foxit a PDF document reader.Foxit 3D Plugin is China's Foxit Foxit a use in the PDF document reader in the 3D plug-in. A security vulnerability exists in Foxit PhantomPDF when processing U3D objects in PDF files. The vulnerability stems from the program failing t...
Debian DLA-2159-1 : okular security update
Mickael Karatekin from Sysdream Labs discovered that the Okular document viewer allows code execution via an action link in a PDF document. For Debian 8 'Jessie', this problem has been fixed in version 4:4.14.2-2+deb8u2. We recommend that you upgrade your okular packages. NOTE: Tenable Network...
CVE-2020-9359
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...
Code injection
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...
UBUNTU-CVE-2020-9359
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document...
