UBUNTU-CVE-2022-38222

There is a use-after-free issue in JBIG2Stream::close located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to for example the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact...

Microsoft Graphics Device Interface Remote Code Execution (CVE-2018-8397)

A remote code execution vulnerability exists in the GDI components of Microsoft Windows. The vulnerability is due to improper handling of objects in memory. A remote attacker could exploit the vulnerability by enticing a user to open a specially crafted document...

DEBIAN-CVE-2021-20224

An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum function in MagickCore/quantum-export.c. Function calls to GetPixelIndex could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead t...

UBUNTU-CVE-2022-38171

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIG2Stream.cc. Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by...

UBUNTU-CVE-2020-27792

A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000printpage function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service...

PT-2022-4483 · Pdf Xchange · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: The issue is related to a buffer overflow in memory, which can be triggered by a specially crafted PDF file. This allows a remote attacker to execute arbitrary code. The flaw...

BigTree CMS 跨站脚本漏洞

BigTree CMS is a content management system. A security vulnerability exists in BigTree CMS version 4.4.16, which stems from the inclusion of an arbitrary file upload issue that allows an attacker to execute arbitrary code via a crafted PDF file...

The vulnerability in the implementation of the util.printf() function allows attackers to execute arbitrary code in PDF viewer and editor applications like Adobe Reader and Adobe Acrobat.

The vulnerability of the util.printf function in PDF viewing and editing applications like Adobe Reader and Adobe Acrobat arises from the execution of operations outside of the buffer in memory, due to improper parameter checking. Exploiting this vulnerability allows a malicious actor to execute...

The vulnerability of the Microsoft PowerPoint presentation preparation program arises from overflowing buffers in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft PowerPoint presentation preparation program arises due to an overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted document...

xerces-j2: infinite loop when handling specially crafted XML document payloads

A flaw was found in the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This issue causes the XercesJ XML parser to wait in an infinite loop, which may consume system resources for a prolonged duration, leading to a denial of service condition...

Exploit for CVE-2022-30190

follina POC All about CVE-2022-30190, aka follina, that is a...

The vulnerability of the Corel WordPerfect text document creation and editing software’s Word97Import200.dll library allows a hacker to execute arbitrary code.

The vulnerability of the Corel WordPerfect text document creation and editing software’s Word97Import200.dll library is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current...

CVE-2021-42613

A double free in cleanupindex in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified impact via a crafted text document...

CVE-2021-42614

A use after free in infowidthinternal in bkinfo.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document...

Design/Logic Flaw

A use after free in infowidthinternal in bkinfo.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document...

GHSA-8GWC-X7MG-7P7P Apache XML Security For Java vulnerable to Infinite Loop

Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method expandSizeint newPos of class org.apache.xml.security.utils.UnsyncByteArrayOutputStream goes in an endless loop. A remote attacker could use...

GHSA-34WJ-P5JM-2P96 Improper Restriction of XML External Entity Reference in python-docx

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

Improper Restriction of XML External Entity Reference in python-docx

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted document...

CVE-2022-27794

Acrobat Reader DC versions 22.001.20085 and earlier, 20.005.3031x and earlier and 17.012.30205 and earlier is affected by the use of a variable that has not been initialized when processing of embedded fonts, potentially resulting in arbitrary code execution in the context of the current user...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the Hints::Hints function, via a crafted PDF file. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other...