PT-2019-13876 · Pdfresurrect+2 · Pdfresurrect+2

Rtfingc · Published 2019-08-11 · Updated 2023-03-02 · CVE-2019-14934

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PDFResurrect versions prior to 0.18

Description An issue was discovered in PDFResurrect where the pdf load pages kids function in pdf.c does not validate a certain size value. This leads to a malloc failure and an out-of-bounds write.

Recommendations For versions prior to 0.18, update to version 0.18 or later to resolve the issue. As a temporary workaround, consider restricting the use of the pdf load pages kids function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-14934

DLA-2475-1

MGASA-2019-0419

USN-5282-1

Affected Products

Linuxmint

Pdfresurrect

Ubuntu

References · 25

• https://github.com/enferex/pdfresurrect/commit/0c4120fffa3dffe97b95c486a120eded82afe8a6 · Patch
• https://github.com/enferex/pdfresurrect/compare/v0.17...v0.18 · Patch
• https://ubuntu.com/security/notices/USN-5282-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DBYXYU2VSDJ3NAL54IW2KYD3TZSR33M · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0419.html · Security Note
• https://osv.dev/vulnerability/CVE-2019-14934 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14934 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14934 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14934 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y243C2IFMRFQWHV62JCSHTMQGDDCICNF · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14934 · Security Note
• https://ubuntu.com/security/CVE-2020-20740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9549 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14934 · Vendor Advisory