PT-2019-14933 · Xpdf · Xpdf

Dhiraj · Published 2019-10-01 · Updated 2019-12-31 · CVE-2019-17064

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xpdf version 4.02

Description The issue arises from a NULL pointer dereference in Catalog.cc due to the late initialization of Catalog.pageLabels in the Catalog constructor.

Recommendations For Xpdf version 4.02, ensure that the Catalog.pageLabels is properly initialized before use to prevent the NULL pointer dereference. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-17064

MGASA-2019-0422

Affected Products

Xpdf

References · 13

• 🔥 https://forum.xpdfreader.com/viewtopic.php?f=3&t=41890 · Exploit
• 🔥 http://packetstormsecurity.com/files/154713/Xpdf-4.02-NULL-Pointer-Dereference.html · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5PYIAP2RXTYD4Y4FYFIK5K644LMDJWX · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17064 · Security Note
• https://ubuntu.com/security/CVE-2019-17064 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0422 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/TMDB2CGUYDW2RENE2I2TT6QNFEEI2CNF · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMDB2CGUYDW2RENE2I2TT6QNFEEI2CNF · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0422.html · Security Note
• https://osv.dev/vulnerability/CVE-2019-17064 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17064 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=25973 · Note