poppler: A logic error in the Hints::Hints function can cause denial of service

A logic error was found in Popplers' Hints::Hints function in the Hints.cc file. This flaw allows an attacker to trick a user into opening a crafted PDf file into the pdftops utility, which causes the program to hang for a long time, leading to a denial of service...

PT-2022-26738 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: XPDF version 4.04 Description: A stack overflow in the Catalog::readPageLabelTree2Object function allows attackers to cause a Denial of Service DoS via a crafted PDF file. Recommendations: For XPDF version 4.04, as a temporary workaround,...

PT-2022-21456 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit Software's PDF Reader version 12.0.1.12430 Description: A use-after-free issue exists in the JavaScript engine of Foxit Software's PDF Reader. This can be triggered by a specially-crafted PDF document that prematurely deletes objects...

The vulnerability of the PDFium component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the PDFium component in the Google Chrome browser relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through a specially created PD...

Adobe ColdFusion Solr Service XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe ColdFusion. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apache Solr service. Due to the improper restriction of XML External Entity...

UBUNTU-CVE-2022-38222

There is a use-after-free issue in JBIG2Stream::close located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to for example the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact...

Microsoft Graphics Device Interface Remote Code Execution (CVE-2018-8397)

A remote code execution vulnerability exists in the GDI components of Microsoft Windows. The vulnerability is due to improper handling of objects in memory. A remote attacker could exploit the vulnerability by enticing a user to open a specially crafted document...

DEBIAN-CVE-2021-20224

An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum function in MagickCore/quantum-export.c. Function calls to GetPixelIndex could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead t...

UBUNTU-CVE-2022-38171

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIG2Stream.cc. Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by...

UBUNTU-CVE-2020-27792

A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000printpage function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service...

PT-2022-4483 · Pdf Xchange · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: The issue is related to a buffer overflow in memory, which can be triggered by a specially crafted PDF file. This allows a remote attacker to execute arbitrary code. The flaw...

BigTree CMS 跨站脚本漏洞

BigTree CMS is a content management system. A security vulnerability exists in BigTree CMS version 4.4.16, which stems from the inclusion of an arbitrary file upload issue that allows an attacker to execute arbitrary code via a crafted PDF file...

The vulnerability in the implementation of the util.printf() function allows attackers to execute arbitrary code in PDF viewer and editor applications like Adobe Reader and Adobe Acrobat.

The vulnerability of the util.printf function in PDF viewing and editing applications like Adobe Reader and Adobe Acrobat arises from the execution of operations outside of the buffer in memory, due to improper parameter checking. Exploiting this vulnerability allows a malicious actor to execute...

The vulnerability of the Microsoft PowerPoint presentation preparation program arises from overflowing buffers in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft PowerPoint presentation preparation program arises due to an overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted document...

xerces-j2: infinite loop when handling specially crafted XML document payloads

A flaw was found in the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This issue causes the XercesJ XML parser to wait in an infinite loop, which may consume system resources for a prolonged duration, leading to a denial of service condition...

Exploit for CVE-2022-30190

follina POC All about CVE-2022-30190, aka follina, that is a...

The vulnerability of the Corel WordPerfect text document creation and editing software’s Word97Import200.dll library allows a hacker to execute arbitrary code.

The vulnerability of the Corel WordPerfect text document creation and editing software’s Word97Import200.dll library is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current...

CVE-2021-42613

A double free in cleanupindex in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified impact via a crafted text document...

CVE-2021-42614

A use after free in infowidthinternal in bkinfo.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document...

Design/Logic Flaw

A use after free in infowidthinternal in bkinfo.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document...