CVE-2019-13283

In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
Affected Products (NVD)
VendorProductVersion
glyphandcogxpdfreader
4.01.01
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xpdf
bookworm
3.04+git20220601-1
fixed
bullseye
3.04+git20210103-3
fixed
sid
3.04+git20240613-1
fixed
trixie
3.04+git20240613-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ipe
bionic
not-affected
cosmic
ignored
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
trusty
dne
xenial
not-affected
libextractor
bionic
not-affected
cosmic
ignored
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
trusty
not-affected
xenial
not-affected
poppler
bionic
not-affected
cosmic
not-affected
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
trusty
dne
xenial
Fixed 0.41.0-0ubuntu1.15
released
xpdf
bionic
not-affected
cosmic
ignored
disco
ignored
eoan
ignored
focal
dne
groovy
dne
hirsute
ignored
impish
ignored
jammy
not-affected
kinetic
not-affected
lunar
not-affected
trusty
dne
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpoppler-cpp0
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
libpoppler-devel
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
libpoppler-glib-devel
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
libpoppler-glib8
suse enterprise sap 12 SP5
0.43.0-16.22.1
fixed
suse enterprise server 12 SP2
0.43.0-16.22.1
fixed
suse enterprise server 12 SP3
0.43.0-16.22.1
fixed
suse enterprise server 12 SP4
0.43.0-16.22.1
fixed
suse enterprise server 12 SP5
0.43.0-16.22.1
fixed
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
libpoppler-qt4-4
suse enterprise sap 12 SP5
0.43.0-16.22.1
fixed
suse enterprise server 12 SP2
0.43.0-16.22.1
fixed
suse enterprise server 12 SP3
0.43.0-16.22.1
fixed
suse enterprise server 12 SP4
0.43.0-16.22.1
fixed
suse enterprise server 12 SP5
0.43.0-16.22.1
fixed
libpoppler60
suse enterprise sap 12 SP5
0.43.0-16.22.1
fixed
suse enterprise server 12 SP2
0.43.0-16.22.1
fixed
suse enterprise server 12 SP3
0.43.0-16.22.1
fixed
suse enterprise server 12 SP4
0.43.0-16.22.1
fixed
suse enterprise server 12 SP5
0.43.0-16.22.1
fixed
libpoppler73
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
poppler-tools
suse enterprise sap 12 SP5
0.43.0-16.22.1
fixed
suse enterprise server 12 SP2
0.43.0-16.22.1
fixed
suse enterprise server 12 SP3
0.43.0-16.22.1
fixed
suse enterprise server 12 SP4
0.43.0-16.22.1
fixed
suse enterprise server 12 SP5
0.43.0-16.22.1
fixed
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
typelib-1_0-Poppler-0_18
suse enterprise server 15 SP1
0.62.0-150000.4.9.1
fixed
Common Weakness Enumeration
References
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41843
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41843
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/