PT-2018-3977 · Foolabs+2 · Xpdf+2

Skysider · Publicado 2018-02-24 · Atualizado 2024-08-08 · CVE-2018-7453

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions xpdf version 4.00

Description The issue is related to infinite recursion in the AcroForm::scanField function in AcroForm.cc, which can be exploited to launch a denial of service attack via a specific pdf file due to the lack of loop checking. This can be demonstrated using pdftohtml. The vulnerability allows attackers to initiate a denial of service.

Recommendations For xpdf version 4.00, consider disabling the AcroForm::scanField function as a temporary workaround until a patch is available. Restrict access to pdf files that could potentially exploit this issue to minimize the risk of denial of service attacks.

Correção

DoS

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

ALT-PU-2024-10474

ALT-PU-2024-10804

ALT-PU-2024-7465

BDU:2024-01226

CVE-2018-7453

Produtos afetados

Alt Linux

Debian

Xpdf

Referências · 10

• https://forum.xpdfreader.com/viewtopic.php?p=814#p814 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-01226 · Nota de Segurança
• https://xpdfreader.com/security-bug/object-loops.html · Nota
• https://ubuntu.com/security/CVE-2018-7453 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-7453 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-7453 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7453 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7453 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7453 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7453 · Aviso do Fabricante