PT-2021-5954 · Pdftron · Pdftron

Published 2021-12-06 · Updated 2023-08-08 · CVE-2021-40161

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PDFTron versions prior to 9.0.7

Description A Memory Corruption issue may lead to code execution through maliciously crafted DLL files. The vulnerability is related to errors in the mechanism for checking the path to dynamically loaded libraries (DLL). Exploitation of the issue may allow a remote attacker to execute arbitrary code by opening a specially crafted malicious PDF file.

Recommendations For versions prior to 9.0.7, update to version 9.0.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of dynamically loaded libraries (DLL) to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-427

CWE-125

CWE-787

Related Identifiers

BDU:2022-00471

CVE-2021-40161

Affected Products

Pdftron

References · 8

• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40161 · Security Note
• https://bdu.fstec.ru/vul/2022-00471 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40161 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20211216.5.pdf · Security Note
• https://t.me/cibsecurity/34579 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021120916 · Note
• https://pdftron.com/documentation/windows/changelog · Note