Описание
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
A stack-based buffer over-read flaw was found in the FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf, where it can be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. This flaw allows an attacker to cause a denial of service or to leak memory data into dump content. The highest threat from this vulnerability is to confidentiality and system availability.
Отчет
Red Hat Enterprise Linux 8 is not affected by this vulnerability because ships newer, already fixed version of poppler.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | poppler | Out of support scope | ||
| Red Hat Enterprise Linux 6 | poppler | Out of support scope | ||
| Red Hat Enterprise Linux 7 | poppler | Will not fix | ||
| Red Hat Enterprise Linux 8 | poppler | Not affected |
Показывать по
Дополнительная информация
Статус:
7.1 High
CVSS3
Связанные уязвимости
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
A stack-based buffer over-read exists in FoFiTrueType::dumpString in f ...
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
7.1 High
CVSS3