The vulnerabilities of PDF viewer programs such as Adobe Reader, Adobe Reader Document Cloud, and PDF editing programs like Adobe Acrobat, Adobe Acrobat Document Cloud allow attackers to execute arbitrary code.

The vulnerability of JavaScript programs for viewing PDF files, such as Adobe Reader, Adobe Reader Document Cloud, and PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, arises due to an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerabili...

UBUNTU-CVE-2017-8054

The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service infinite recursion and application crash via a crafted PDF document...

DEBIAN-CVE-2017-8054

The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service infinite recursion and application crash via a crafted PDF document...

[SECURITY] Fedora 26 Update: mupdf-1.10a-5.fc26

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

CVE-2017-3017

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability when handling a malformed PDF file. Successful exploitation could lead to arbitrary code execution...

[SECURITY] Fedora 26 Update: ghostscript-9.20-8.fc26

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures the Ghostscript library, which implements the graphics capabilities in the PostScript language and an interpreter for Portable Document Format PDF files. Ghostscript translates PostScript code into many...

[SECURITY] Fedora 25 Update: ghostscript-9.20-7.fc25

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures the Ghostscript library, which implements the graphics capabilities in the PostScript language and an interpreter for Portable Document Format PDF files. Ghostscript translates PostScript code into many...

PoDoFo Denial of Service Vulnerability (CNVD-2017-04562)

PoDoFo is an open source , written in C++ using the PDF file format library . A denial of service vulnerability exists in PdfFontFactory.cpp:195:62 code in PoDoFo version 0.9.5 that allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted P...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted PDF document. Remediation There is no fixed...

UBUNTU-CVE-2016-10220

The gsmakewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted file that is mishandled in the PDF Transparency module...

[SECURITY] Fedora 26 Update: webkitgtk4-2.16.0-1.fc26

WebKitGTK+ is the port of the portable web rendering engine WebKit to the GTK+ platform. This package contains WebKitGTK+ for GTK+ 3...

[SECURITY] Fedora 25 Update: webkitgtk4-2.16.0-1.fc25

WebKitGTK+ is the port of the portable web rendering engine WebKit to the GTK+ platform. This package contains WebKitGTK+ for GTK+ 3...

[SECURITY] Fedora 24 Update: webkitgtk4-2.16.0-1.fc24

WebKitGTK+ is the port of the portable web rendering engine WebKit to the GTK+ platform. This package contains WebKitGTK+ for GTK+ 3...

pngdefry 'pngdefry.c' heap buffer overflow vulnerability

pngdefry is a suite of applications for iPhone and iPad to modify PNG images. A heap buffer overflow vulnerability exists in pngdefry 2017-03-22 and earlier versions. Due to the program failing to properly handle specially crafted png files. An attacker could exploit the vulnerability to cause a...

The vulnerability of the Windows operating system and the Microsoft Edge browser allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows operating system’s PDF library, specifically Microsoft Edge browsers, arises due to an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created Microsoft...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure

The vulnerability of the SpliceImage function in the console-based image editing tool ImageMagick is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure application termination by using a specially created PNG file...

CVE-2017-0023

The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."...

Microsoft Windows PDF Memory Corruption Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. PDF library is one of the PDF library. A memory corruption vulnerability exists in Microsoft Windows PDF. A remote attacker could exploit this vulnerability to build a malicious web page, which could ...

CVE-2016-8863

Heap-based buffer overflow in the createurllist function in gena/genadevice.c in Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an...

CVE-2016-8863

Heap-based buffer overflow in the createurllist function in gena/genadevice.c in Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an...