CVE-2017-15245

IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at PDF!xmlGetGlobalState+0x0000000000057b76."...

CVE-2017-15239

CVE-2017-15239 affects IrfanView 4.44 (32‑bit) with PDF plugin 4.43. The vulnerability arises in the PDF handling, described as a buffer/heap related issue that can allow denial of service or possibly other impact when processing a crafted PDF, related to data from a faulting address in the XML/P...

CVE-2017-15258

IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlParserInputRead+0x0000000000161a9c."...

CVE-2017-15244

IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to an "Error Code 0xe06d7363 starting at wow64!Wow64NotifyDebugger+0x000000000000001d."...

CVE-2017-15245

CVE-2017-15245 affects IrfanView 4.44 (32‑bit) with PDF plugin 4.43. The vulnerability enables denial of service and potentially other impact via a crafted PDF, related to data from a faulting address controlling branch/Code flow in PDF parsing (XML/Parser paths cited in the advisory). Connected ...

CVE-2017-15244

CVE-2017-15244 affects IrfanView 4.44 (32‑bit) with PDF plugin 4.43. A crafted PDF can trigger a buffer overflow in the PDF plugin, leading to denial of service and potentially other impact. The CVSS data indicate local exploitation with the potential for high impact on confidentiality, integrity...

CVE-2017-15256

CVE-2017-15256 affects IrfanView 4.44 (32-bit) with PDF plugin 4.43. A crafted PDF can cause a denial of service (and potentially other impact) due to a faulting address handling issue in PDF parsing (PDF!xmlListWalk+0x…); idle exploitation details indicate local conditions and potential code exe...

CVE-2017-15257

CVE-2017-15257 affects IrfanView 4.44 (32‑bit) with PDF plugin 4.43. The connected CNVD entry confirms a buffer overflow in the PDF handling path that can be triggered by a specially crafted PDF file, enabling a local attacker to execute arbitrary code or cause a denial of service. The vulnerabil...

CVE-2017-15254

CVE-2017-15254 affects IrfanView 4.44 (32-bit) with PDF plugin 4.43. A crafted PDF file can trigger a Read Access Violation in PDF parser (PDF!xmlGetGlobalState) leading to DoS or potentially other impacts. Root cause: memory/validation issue in PDF handling. Affected product: IrfanView 4.44 with...

CVE-2017-15260

IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address may be used as a return value starting at PDF!xmlParserInputRead+0x0000000000129a59."...

CVE-2017-15263

CVE-2017-15263 affects IrfanView 4.44 (32‑bit) with PDF plugin 4.43. A crafted PDF can trigger a buffer overflow in the PDF handling code, leading to a denial of service and potentially other impacts. Several connected advisories describe memory/heap corruption patterns and data‑flow issues aroun...

CVE-2017-15246

CVE-2017-15246 affects IrfanView 4.44 (32‑bit) with PDF plugin 4.43 . The issue is a buffer/read access violation in the PDF handling (Read Access Violation on Block Data Move) that can allow a local attacker to execute arbitrary code or cause a denial of service via a crafted PDF. The CVSS indic...

CVE-2017-15252

IrfanView version 4.44 32bit with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to a "Read Access Violation on Block Data Move starting at PDF!xmlListWalk+0x00000000000158cb."...

Xxe

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

CVE-2017-6344

CVE-2017-6344 describes an XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 that allows an attacker to read arbitrary files by submitting a crafted XML document. The issue arises from XXE in the plugin’s XML processing. Public references (NVD entry and CNVD/PRION/CVE landings) con...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

Grails PDF Plugin 0.6 - XML External Entity Injection

Grails PDF Plugin 0.6 - XML External Entity Injection Exploit Title: Grails PDF Plugin 0.6 XXE Date: 21/02/2017 Vendor Homepage: http://www.grails.org/plugin/pdf Software Link: https://github.com/aeischeid/grails-pdfplugin Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website...

Grails PDF Plugin 0.6 - XML External Entity Injection

Exploit Title: Grails PDF Plugin 0.6 XXE Date: 21/02/2017 Vendor Homepage: http://www.grails.org/plugin/pdf Software Link: https://github.com/aeischeid/grails-pdfplugin Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website: https://www.ambionics.io/blog/grails-pdf-plugin-xxe...

Design/Logic Flaw

The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...