PT-2017-13796 · Poppler+2 · Poppler+2
Albert Astals Cid
·
Publicado
2017-10-01
·
Atualizado
2019-05-03
·
CVE-2017-14976
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Poppler version 0.59.0
Description
The issue arises from a heap-based buffer over-read in the FoFiType1C::convertToType0 function, located in FoFiType1C.cc. This occurs when an out-of-bounds font dictionary index is encountered, allowing an attacker to potentially launch a denial of service attack.
Recommendations
For Poppler version 0.59.0, consider applying a patch or updating to a newer version that addresses this issue, if available. As a temporary workaround, restrict access to potentially malicious font files to minimize the risk of exploitation.
Exploit
Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Poppler
Suse
Ubuntu