52 results · Feed
-
Low 2.1
Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
-
Low 2.1
Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
-
Low 2.1
Out-of-bounds array write in Xpdf 4.06 due to missing validation
Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.
-
Low 2.1
Stack overflow in Xpdf 4.05 due to object loop in PDF CMap
In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow.
-
Low 2.1
Out-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.05
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid VerticesPerRow value in a PDF shading dictionary.
-
Low 2.1
Out-of-bounds array write in Xpdf 4.05 due to incorrect integer overflow checking
Out-of-bounds array write in Xpdf 4.05 and earlier, due to incorrect integer overflow checking in the PostScript function interpreter code.
-
Low 2.1
Uninitialized variable in Xpdf 4.05 due to invalid JPEG header
In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.
-
Low 2.1
Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinates
In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero.
-
Low 2.1
Stack overflow in Xpdf 4.05 due to object loop in PDF pattern
In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow.
-
Low 2.1
Out-of-bounds array write in Xpdf 4.05 due to missing object type check
Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.
-
Low 2.9
Stack overflow in Xpdf 4.05 due to object loop in PDF resources
In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow.
-
Low 2.9
Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.
-
Low 2.9
Stack overflow in Xpdf 4.05 due to object loop in attachments
In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.
-
Low 2.9
Stack overflow in Xpdf 4.05 due to object loop in PDF object stream
In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow.
-
Low 2.9
Out-of-bounds array access due to negative object numbers in indirect references in Xpdf 4.05
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference in the input PDF file.
-
Unscored —
An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
-
Low 3.3
Deadlock in Xpdf 4.04 due to PDF object stream references
Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
-
Low 3.3
Divide-by-zero in Xpdf 4.04 due to very large page size
An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by…
-
Low 2.9
Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file tree
In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.
-
Low 2.9
Stack overflow in Xpdf 4.04 due to object loop in PDF page label tree
In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.
-
Low 2.9
Divide-by-zero in Xpdf 4.04 due to bad color space object
In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.
-
High 7.5
-
Unscored —
XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
-
Unscored —
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the f…
-
Unscored —
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
-
Unscored —
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2…
-
Unscored —
There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.
-
Unscored —
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
-
Unscored —
The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to ca…
-
Unscored —
The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL p…
-
Unscored —
The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based…
-
Unscored —
CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based bu…
-
Unscored —
The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL p…
-
Unscored —
The function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NUL…
-
Unscored —
SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (h…
-
Unscored —
XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack consumption) via a craf…
-
Unscored —
The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to caus…
-
Unscored —
The JPXStream::readTilePart function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-ba…
-
Unscored —
The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buf…
-
Unscored —
The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (hea…