Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,997 results · page 44 of 60

Oct 9, 2019A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522.CVE-2019-5050 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
Product
Nitropdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Oct 9, 2019A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522.CVE-2019-5048 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
Product
Nitropdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Oct 9, 2019An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF.CVE-2019-5047 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a Use After Free. An attacker can craft a malicious PDF to trigger this vulnerability.
Product
Nitropdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Oct 9, 2019A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522.CVE-2019-5046 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
Product
Nitropdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Oct 9, 2019A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522.CVE-2019-5045 · Other software · Gonitro · reported by talos-cna@cisco.comHigh 7.8
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
Product
Nitropdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Oct 4, 2019This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.CVE-2019-6776 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing watermarks within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8801.
Product
PhantomPDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Oct 4, 2019This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.CVE-2019-13317 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8759.
Product
PhantomPDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Oct 4, 2019This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.CVE-2019-13316 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8757.
Product
PhantomPDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Oct 2, 2019An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828.CVE-2019-5031 · Other software · Foxitsoftware · reported by talos-cna@cisco.comHigh 8.8
An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted PDF document can trigger an out-of-memory condition which isn't handled properly, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Oct 1, 2019Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.CVE-2019-17064 · Other software · Glyphandcog · reported by MITREMedium 5.5
Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com forum.xpdfreader.com
Oct 1, 2019In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mishandling.CVE-2019-17063 · Other software · Snowtide · reported by MITREMedium 5.5
In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mishandling.
Product
Pdfxstream
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.snowtide.com downloads.snowtide.com
Sep 27, 2019Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerability than CVE-2019-CVE-2019-16927 · Other software · Glyphandcog · reported by MITREMedium 5.5
Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerability than CVE-2019-9877.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 20, 2019The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.CVE-2019-15138 · Other software · Html-pdf Project · reported by MITREHigh 7.5
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
Product
Html-pdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com npmjs.com
Sep 18, 2019An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers.CVE-2019-5067 · Other software · Talos · reported by talos-cna@cisco.comCritical 9.8
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory, resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerability, a specifically crafted PDF document needs to be processed by the target application.
Product
Aspose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Sep 18, 2019An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++.CVE-2019-5066 · Other software · Talos · reported by talos-cna@cisco.comCritical 9.8
An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free condition. To trigger this vulnerability, a specifically crafted PDF document needs to be processed by the target application.
Product
Aspose
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Sep 18, 2019An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++.CVE-2019-5042 · Other software · Talos · reported by talos-cna@cisco.comHigh 8.8
An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free. An attacker can send a malicious PDF to trigger this vulnerability.
Product
Aspose.PDF for C++
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Sep 8, 2019In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor.CVE-2019-16115 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 6, 2019Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc.CVE-2019-16088 · Other software · Glyphandcog · reported by MITREMedium 5.5
Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 3, 2019A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabliCVE-2019-14817 · Other software · Artifex Software · reported by Red HatHigh 7.8
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Product
ghostscript
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.ghostscript.com lists.opensuse.org
Sep 3, 2019A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling CVE-2019-14811 · Other software · Artifex Software · reported by Red HatHigh 7.8
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Product
ghostscript
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Sep 3, 2019Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc.CVE-2019-15860 · Other software · Glyphandcog · reported by MITREMedium 5.5
Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Aug 30, 2019The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.CVE-2019-15842 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
Product
easy-pdf-restaurant-menu-upload
Fixed in
1.1.2
What to do
Update easy-pdf-restaurant-menu-upload to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 29, 2019Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.CVE-2019-15783 · Other software · Lute-tab Project · reported by MITRECritical 9.8
Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.
Product
Lute-tab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 21, 2019The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.CVE-2018-20970 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
2.0.3
What to do
Update pdf-print to 2.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.CVE-2017-18528 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
1.9.4
What to do
Update pdf-print to 1.9.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string.CVE-2019-14975 · Other software · Artifex · reported by MITREHigh 7.1
Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string.
Product
Mupdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.ghostscript.com bugs.ghostscript.com
Aug 12, 2019The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.CVE-2017-18506 · WordPress plugins & themes · reported by MITREMedium 6.1
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
Product
woocommerce-pdf-invoices-packing-slips
Fixed in
2.0.13
What to do
Update woocommerce-pdf-invoices-packing-slips to 2.0.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 11, 2019An issue was discovered in PDFResurrect before 0.18.CVE-2019-14934 · Other software · Pdfresurrect Project · reported by MITREHigh 7.8
An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write.
Product
Pdfresurrect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 29, 2019PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.CVE-2019-14267 · Other software · Pdfresurrect Project · reported by MITREHigh 7.8
PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.
Product
Pdfresurrect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14294 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc, due to an out of bounds read.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14293 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 2.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14292 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14291 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 3.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14290 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 2.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14289 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "multiple bytes per line" case.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14288 · Other software · Glyphandcog · reported by MITREHigh 7.8
An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "one byte per line" case.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-14215 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling xfa.event.rest XFA JavaScript due to accessing a wild pointer.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-14214 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a JavaScript Denial of Service when deleting pages in a document that contains only one page by calling a "t.hidden = true" function.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-14213 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the repeated release of the signature dictionary during CSG_SignatureF and CPDF_Document destruction.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-14212 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling certain XFA JavaScript due to the use of, or access to, a NULL pointer without proper validation on the object.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-14211 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the lack of proper validation of the existence of an object prior to performing operations on that object when executing JavaScript.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-14210 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Memory Corruption due to the use of an invalid pointer copy, resulting from a destructed string object.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-14209 · Other software · Foxitsoftware · reported by MITRECritical 9.8
An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Heap Corruption due to data desynchrony when adding AcroForm.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.10.CVE-2019-14208 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a NULL pointer dereference and crash when getting a PDF object from a document, or parsing a certain portfolio that contains a null dictionary.
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Jul 21, 2019An issue was discovered in Foxit PhantomPDF before 8.3.11.CVE-2019-14207 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling the clone function due to an endless loop resulting from confusing relationships between a child and parent object (caused by an append error).
Product
Phantompdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com foxitsoftware.com
Jul 4, 2019In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc.CVE-2019-13291 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Information Disclosure.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Jul 4, 2019Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary coCVE-2019-13290 · Other software · Artifex · reported by MITREHigh 7.8
Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node.
Product
Mupdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.ghostscript.com git.ghostscript.com
Jul 4, 2019In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc.CVE-2019-13289 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 4, 2019In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file.CVE-2019-13288 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 4, 2019In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc.CVE-2019-13287 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.