Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

89 results · page 1 of 2

Aug 22, 2023An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.CVE-2022-48545 · Other software · Xpdfreader · reported by MITREMedium 5.5
An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Apr 26, 2023Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function.CVE-2023-26930 · Other software · Xpdfreader · reported by MITREMedium 5.5
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Feb 15, 2023Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.CVE-2022-45587 · Other software · Xpdfreader · reported by MITREMedium 5.5
Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Feb 15, 2023Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.CVE-2022-45586 · Other software · Xpdfreader · reported by MITREMedium 5.5
Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Feb 3, 2023Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.CVE-2021-36493 · Other software · Xpdfreader · reported by MITREHigh 7.5
Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Nov 15, 2022A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.CVE-2022-43071 · Other software · Xpdfreader · reported by MITREMedium 5.5
A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Nov 14, 2022XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.CVE-2022-43295 · Other software · Xpdfreader · reported by MITREMedium 5.5
XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Nov 10, 2022xpdfreader 4.03 is vulnerable to Buffer Overflow.CVE-2021-40226 · Other software · Glyphandcog · reported by MITREHigh 7.5
xpdfreader 4.03 is vulnerable to Buffer Overflow.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 30, 2022An issue was discovered in Xpdf 4.04.CVE-2022-41844 · Other software · Xpdfreader · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com forum.xpdfreader.com
Sep 30, 2022An issue was discovered in Xpdf 4.04.CVE-2022-41843 · Other software · Xpdfreader · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 30, 2022An issue was discovered in Xpdf 4.04.CVE-2022-41842 · Other software · Xpdfreader · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com forum.xpdfreader.com
Sep 28, 2022There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04.CVE-2022-38222 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 21, 2022XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.CVE-2022-38928 · Other software · Xpdfreader · reported by MITREHigh 7.8
XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 15, 2022XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.CVE-2022-38334 · Other software · Xpdfreader · reported by MITREMedium 5.5
XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Aug 30, 2022XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.CVE-2022-36561 · Other software · Xpdfreader · reported by MITREMedium 5.5
XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Aug 30, 2022Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.CVE-2022-24107 · Other software · Glyphandcog · reported by MITREHigh 7.8
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com dl.xpdfreader.com
Aug 30, 2022In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unkCVE-2022-24106 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com dl.xpdfreader.com
Aug 22, 2022Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc).CVE-2022-38171 · Other software · Xpdfreader · reported by MITREHigh 7.8
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com xpdfreader.com
Jun 28, 2022XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.CVE-2022-33108 · Other software · Xpdfreader · reported by MITREHigh 7.8
XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
May 18, 2022There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.CVE-2021-27548 · Other software · Xpdfreader · reported by MITREMedium 5.5
There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
May 15, 2022xpdf 4.04 allocates excessive memory when presented with crafted input.CVE-2022-30775 · Other software · Xpdfreader · reported by MITREMedium 5.5
xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
May 9, 2022There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinateCVE-2022-30524 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Apr 25, 2022xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc.CVE-2022-27135 · Other software · Xpdfreader · reported by MITREMedium 5.5
xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified effects by sending a crafted PDF file to the pdftoppm binary.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Dec 25, 2020Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function.CVE-2020-35376 · Other software · Xpdfreader · reported by MITREHigh 7.5
Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.fedoraproject.org
Sep 3, 2020There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2.CVE-2020-24999 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 3, 2020There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2.CVE-2020-24996 · Other software · Xpdfreader · reported by MITREHigh 7.8
There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Oct 1, 2019Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.CVE-2019-17064 · Other software · Glyphandcog · reported by MITREMedium 5.5
Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com forum.xpdfreader.com
Sep 8, 2019In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor.CVE-2019-16115 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Sep 6, 2019Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc.CVE-2019-16088 · Other software · Glyphandcog · reported by MITREMedium 5.5
Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 3, 2019Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc.CVE-2019-15860 · Other software · Glyphandcog · reported by MITREMedium 5.5
Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14294 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc, due to an out of bounds read.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14293 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 2.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14292 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14291 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 3.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14290 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 2.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14289 · Other software · Glyphandcog · reported by MITREMedium 5.5
An issue was discovered in Xpdf 4.01.01. There is an integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "multiple bytes per line" case.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 27, 2019An issue was discovered in Xpdf 4.01.01.CVE-2019-14288 · Other software · Glyphandcog · reported by MITREHigh 7.8
An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "one byte per line" case.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com github.com
Jul 4, 2019In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc.CVE-2019-13291 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Information Disclosure.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com forum.xpdfreader.com
Jul 4, 2019In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc.CVE-2019-13289 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 4, 2019In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file.CVE-2019-13288 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 4, 2019In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc.CVE-2019-13287 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 4, 2019In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc.CVE-2019-13286 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.fedoraproject.org
Jul 4, 2019In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source stCVE-2019-13283 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.fedoraproject.org
Jul 4, 2019In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples.CVE-2019-13282 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.fedoraproject.org
Jul 4, 2019In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory.CVE-2019-13281 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service, an information leak, or possibly unspecified other impact.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.fedoraproject.org
Jun 24, 2019In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second priCVE-2019-12958 · Other software · Glyphandcog · reported by MITREMedium 5.5
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element, because the privateDicts array has only one element allocated.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.fedoraproject.org
Jun 24, 2019In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset arraCVE-2019-12957 · Other software · Glyphandcog · reported by MITREHigh 7.8
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.fedoraproject.org
Jun 1, 2019There is an out-of-bounds read vulnerability in the function FlateStream::getChar() located at Stream.cc in Xpdf 4.01.01.CVE-2019-12515 · Other software · Glyphandcog · reported by MITREHigh 7.1
There is an out-of-bounds read vulnerability in the function FlateStream::getChar() located at Stream.cc in Xpdf 4.01.01. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure or a denial of service.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.fedoraproject.org
May 30, 2019A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mCVE-2019-12493 · Other software · Glyphandcog · reported by MITREHigh 7.1
A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.debian.org
May 27, 2019A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01.CVE-2019-12360 · Other software · Glyphandcog · reported by MITREHigh 7.1
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
Product
Xpdfreader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.xpdfreader.com lists.debian.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.