CVE-2019-13283

CVE-2019-13283 affects Xpdf 4.01.01 and is a heap-based over-read in FoFiType1::parse (FoFiType1.cc) triggered by crafted PDFs; the source string length isn’t validated before a fixed-length strncpy copy, enabling potential Denial of Service or information leakage via crafted PDFs (pdftotext). Re...

CVE-2019-13283

In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the...

CVE-2019-13283: Out-of-bounds Read

In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the...

PT-2019-13051

Name of the Vulnerable Software and Affected Versions Xpdf version 4.01.01 Description A heap-based buffer over-read issue exists in the FoFiType1C::convertToType0 function, located in fofi/FoFiType1C.cc. This occurs when the function attempts to access the second privateDicts array element,...

Xpdf buffer overflow vulnerability (CNVD-2019-16390)

Xpdf is an open source PDF reader from Foo Labs. The product supports decoding LZW compressed format files and read encrypted PDF files. Xpdf 4.01.01 version of the fofi/FoFiTrueType.cc file of the FoFiTrueType::dumpString there is a buffer overflow vulnerability that can be exploited by an...

EulerOS 2.0 SP5 : poppler (EulerOS-SA-2019-1010)

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - poppler: out of bounds read in pdfunite CVE-2018-13988 - poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph function allows...

Poppler Denial of Service Vulnerability (CNVD-2018-09469)

Poppler is a C++ class library for generating PDF, the library is inherited from Xpdf PDF reader. A security vulnerability exists in the 'FoFiType1C::cvtGlyph' function in the fofi/FoFiType1C.cc file in Poppler 0.64.0 and earlier versions. The vulnerability can be exploited by a remote attacker t...

CVE-2017-18267

The CVE-2017-18267 entry affects Poppler (FoFiType1C::cvtGlyph in FoFiType1C.cc) and describes a vulnerability in which a crafted PDF can trigger an infinite recursion, causing a denial of service (via pdftops). The issue is in Poppler up to version 0.64.0, with exploitation demonstrated by proce...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial...

DEBIAN-CVE-2017-14977

The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack...

UBUNTU-CVE-2017-14975

The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initialized, which allows an attacker to launch a denial of service attack...

xpdf: array indexing error in FoFiType1::parse()

The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code v...

xpdf: array indexing error in FoFiType1::parse()

The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code v...

xpdf: buffer overflow in FoFiType1::parse

The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a...