Vulnetix
Try Vulnetix Request Demo
CVE-2019-13283 PUBLISHED

In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.

EPSS 0.30% · 52.8th percentile

Risk Scores

EPSS Score
0.30%
52.8th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSpoppler0, 0.33.0-0ubuntu3, 0.37.0-0ubuntu1

Timeline

References

Open in Interactive Console →