Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,997 results · page 56 of 60

Nov 23, 2013Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (CVE-2013-4474 · Other software · Canonical · reported by Red HatMedium 5
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.
Product
Ubuntu Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org cgit.freedesktop.org
Nov 23, 2013Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (CVE-2013-4473 · Other software · Freedesktop · reported by Red HatHigh 7.5
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.
Product
Poppler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org cgit.freedesktop.org
Oct 30, 2013PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackerCVE-2013-5598 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.3
PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Oct 9, 2013Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF documCVE-2013-5325 · Email & office · Adobe · reported by AdobeHigh 9.3
Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF document.
Product
Acrobat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com oval.cisecurity.org
Oct 4, 2013Stack-based buffer overflow in PDFAX0722_IconCool.dll 7.22.1125.2121 in IconCool PDFCool Studio 3.32 Build 130330 and earlier allows remote attackers to executeCVE-2013-4986 · Other software · Iconcool · reported by MITREMedium 6.8
Stack-based buffer overflow in PDFAX0722_IconCool.dll 7.22.1125.2121 in IconCool PDFCool Studio 3.32 Build 130330 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file.
Product
Pdfcool Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com osvdb.org
Oct 3, 2013Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working dCVE-2013-3248 · Other software · Corel · reported by PSIRT-CNA@flexerasoftware.comHigh 9.3
Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .pdf or .xps file.
Product
PDF Fusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 3, 2013Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a loCVE-2013-0742 · Other software · Corel · reported by PSIRT-CNA@flexerasoftware.comHigh 9.3
Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long ZIP directory entry name in an XPS file.
Product
PDF Fusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 10, 2013Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (CVE-2013-4232 · Other software · Libtiff · reported by Red HatMedium 6.8
Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.
Product
Libtiff
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.maptools.org rhn.redhat.com
Aug 30, 2013Multiple untrusted search path vulnerabilities in Soda PDF 5.1.183.10520 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) api-ms-wiCVE-2013-3485 · Other software · Lulusoftware · reported by PSIRT-CNA@flexerasoftware.comMedium 6.9
Multiple untrusted search path vulnerabilities in Soda PDF 5.1.183.10520 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) api-ms-win-core-localregistry-l1-1-0.dll file in the current working directory.
Product
Soda PDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Jul 3, 2013Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (applicaCVE-2013-1961 · Other software · Remotesensing · reported by Red HatHigh 9.3
Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.
Product
Libtiff
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Jul 3, 2013Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service CVE-2013-1960 · Other software · Remotesensing · reported by Red HatHigh 9.3
Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file.
Product
Libtiff
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Jun 4, 2013The PDF functionality in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service (invalid free operation) or possibly have unspeCVE-2013-2864 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
The PDF functionality in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via unknown vectors.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com code.google.com
May 13, 2013pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF fCVE-2013-2021 · Other software · Canonical · reported by Red HatMedium 4.3
pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.
Product
Ubuntu Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.clamav.net lists.apple.com
Apr 25, 2013converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.CVE-2013-1948 · Other software · ROB Westgeest · reported by Red HatHigh 10
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Product
Md2pdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org vapid.dhs.org
Mar 15, 2013Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (applicatiCVE-2013-0971 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted ink annotations in a PDF document.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.apple.com
Feb 24, 2013Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDCVE-2013-0113 · Other software · Nuance · reported by cret@cert.orgHigh 9.3
Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.
Product
PDF Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Feb 23, 2013Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackerCVE-2013-0897 · Other software · Opensuse · reported by chrome-cve-admin@google.comMedium 4.3
Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service via a crafted document.
Product
Opensuse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com lists.opensuse.org
Jan 26, 2013Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a crafted stream.CVE-2012-4914 · Other software · Coolpdf · reported by PSIRT-CNA@flexerasoftware.comHigh 9.3
Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a crafted stream.
Product
Coolpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com protekresearchlab.com
Jan 26, 2013Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrary code via a crafted document containing CVE-2013-0107 · Other software · Foxitsoftware · reported by cret@cert.orgHigh 7.6
Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrary code via a crafted document containing instructions that reconstruct a certain security cookie.
Product
Foxit Advanced PDF Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Jan 15, 2013The PDF functionality in Google Chrome before 24.0.1312.52 does not properly perform a cast of an unspecified variable during processing of the root of the struCVE-2013-0828 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
The PDF functionality in Google Chrome before 24.0.1312.52 does not properly perform a cast of an unspecified variable during processing of the root of the structure tree, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com code.google.com
Jan 15, 2013Google Chrome before 24.0.1312.52 does not properly handle image data in PDF documents, which allows remote attackers to cause a denial of service (out-of-boundCVE-2012-5157 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Google Chrome before 24.0.1312.52 does not properly handle image data in PDF documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com code.google.com
Nov 22, 2012Cross-site scripting (XSS) vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remoCVE-2012-2084 · Other software · Joao Ventura · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably the PATH_INFO.
Product
Print
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Oct 25, 2012Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a ..CVE-2011-5219 · Other software · Mpdf1 · reported by MITREMedium 5
Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Product
Mpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 8, 2012Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow remote attackers to exeCVE-2012-5324 · Other software · Tracker-software · reported by MITREHigh 9.3
Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow remote attackers to execute arbitrary code via a long string in the (1) sub_path parameter to the StoreInRegistry function or (2) sub_key parameter to the InitFromRegistry function.
Product
Pdf-xchange
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Oct 5, 2012Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability thanCVE-2012-4896 · Other software · Sumatrapdfreader · reported by MITREHigh 9.3
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4895.
Product
Sumatrapdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com secunia.com
Oct 5, 2012Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability thanCVE-2012-4895 · Other software · Sumatrapdfreader · reported by MITREHigh 9.3
Heap-based buffer overflow in SumatraPDF before 2.1 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2012-4896.
Product
Sumatrapdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com secunia.com
Sep 26, 2012The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via veCVE-2012-2895 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com code.google.com
Sep 26, 2012Use-after-free vulnerability in the PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly haveCVE-2012-2890 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Use-after-free vulnerability in the PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com code.google.com
Sep 26, 2012Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafteCVE-2012-2875 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com code.google.com
Sep 19, 2012The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdf_merCVE-2012-5007 · Other software · Wizonesolutions · reported by MITREMedium 5
The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdf_merge_pdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are obtained from third party information.
Product
Fillpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org osvdb.org
Sep 19, 2012Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7CVE-2012-1625 · Other software · Wizonesolutions · reported by Red HatMedium 6
Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors. NOTE: Some of these details are obtained from third party information.
Product
Fillpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org osvdb.org
Sep 7, 2012Untrusted search path vulnerability in PDF-XChange Viewer 2.0 Build 54.0 allows local users to gain privileges via a Trojan horse wintab32.dll file in the curreCVE-2010-5245 · Other software · Tracker-software · reported by MITREMedium 6.9
Untrusted search path vulnerability in PDF-XChange Viewer 2.0 Build 54.0 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .pdf file. NOTE: some of these details are obtained from third party information.
Product
Pdf-xchange Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com corelan.be
Sep 6, 2012Multiple untrusted search path vulnerabilities in Nuance PDF Reader 6.0 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) exceptiondCVE-2010-5209 · Other software · Nuance · reported by MITREMedium 6.9
Multiple untrusted search path vulnerabilities in Nuance PDF Reader 6.0 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) exceptiondumpdll.dll file in the current working directory, as demonstrated by a directory that contains a .pdf file. NOTE: some of these details are obtained from third party information.
Product
PDF Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record core.yehg.net secunia.com
Aug 31, 2012Stack-based buffer overflow in the Image2PDF function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0, Gold CVE-2010-5194 · Other software · Viscomsoft · reported by MITREHigh 9.3
Stack-based buffer overflow in the Image2PDF function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0, Gold 5.5, Gold 6.0, and earlier allows remote attackers to execute arbitrary code via a long strPDFFile parameter.
Product
Image Viewer CP Gold SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com exploit-db.com
Aug 23, 2012Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggersCVE-2012-4337 · Other software · Foxitsoftware · reported by MITREHigh 9.3
Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Aug 13, 2012The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certaCVE-2012-3401 · Other software · Libtiff · reported by Red HatMedium 6.8
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Product
Libtiff
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record libjpeg-turbo.svn.sourceforge.net lists.opensuse.org
Aug 9, 2012The PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via veCVE-2012-2863 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
The PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Aug 9, 2012Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly haveCVE-2012-2862 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Aug 6, 2012The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers tCVE-2012-2856 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Aug 6, 2012Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome CVE-2012-2855 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com googlechromereleases.blogspot.com
Aug 6, 2012The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly handle CVE-2012-2852 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
The PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly handle object linkage, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com googlechromereleases.blogspot.com
Aug 6, 2012Multiple integer overflows in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome FrCVE-2012-2851 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Multiple integer overflows in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Aug 6, 2012Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows andCVE-2012-2850 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to have an unknown impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Jul 22, 2012Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitCVE-2012-2113 · Other software · Libtiff · reported by Red HatMedium 6.8
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
Product
Libtiff
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org rhn.redhat.com
Jul 17, 2012Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, integrity, and availability, related to Gnome PDF viewer.CVE-2012-3129 · Other software · SUN · reported by secalert_us@oracle.comMedium 5.1
Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, integrity, and availability, related to Gnome PDF viewer.
Product
Sunos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org mandriva.com
Jul 12, 2012The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause a denial of service CVE-2012-2844 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 9.3
The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause a denial of service (incorrect object access) or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com googlechromereleases.blogspot.com
Jun 27, 2012Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly havCVE-2012-2833 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com googlechromereleases.blogspot.com
Jun 27, 2012The image-codec implementation in the PDF functionality in Google Chrome before 20.0.1132.43 does not initialize an unspecified pointer, which allows remote attCVE-2012-2832 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
The image-codec implementation in the PDF functionality in Google Chrome before 20.0.1132.43 does not initialize an unspecified pointer, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com googlechromereleases.blogspot.com
Jun 27, 2012Multiple integer overflows in the PDF functionality in Google Chrome before 20.0.1132.43 allow remote attackers to cause a denial of service or possibly have unCVE-2012-2828 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Multiple integer overflows in the PDF functionality in Google Chrome before 20.0.1132.43 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com googlechromereleases.blogspot.com
Jun 27, 2012The PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.CVE-2012-2822 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5
The PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record googlechromereleases.blogspot.com oval.cisecurity.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.