Xpdf
by Xpdf
CVEs (171)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-7866 | 0.00 | — | 0.00 | Aug 15, 2024 | In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. | |||
| CVE-2024-4976 | 0.00 | — | 0.00 | May 15, 2024 | Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference. | |||
| CVE-2024-4568 | 0.00 | — | 0.00 | May 6, 2024 | In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. | |||
| CVE-2024-4141 | 0.00 | — | 0.00 | Apr 24, 2024 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers. | |||
| CVE-2024-3900 | 0.00 | — | 0.00 | Apr 17, 2024 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText. | |||
| CVE-2024-3248 | 0.00 | — | 0.00 | Apr 2, 2024 | In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow. | |||
| CVE-2024-3247 | 0.00 | — | 0.00 | Apr 2, 2024 | In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow. | |||
| CVE-2024-2971 | 0.00 | — | 0.00 | Mar 26, 2024 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference in the input PDF file. | |||
| CVE-2022-48545 | 0.00 | — | 0.00 | Aug 22, 2023 | An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02. | |||
| CVE-2023-3436 | 0.00 | — | 0.00 | Jun 27, 2023 | Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream. | |||
| CVE-2023-3044 | 0.00 | — | 0.00 | Jun 2, 2023 | An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large… | |||
| CVE-2023-2664 | 0.00 | — | 0.00 | May 11, 2023 | In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow. | |||
| CVE-2023-2663 | 0.00 | — | 0.00 | May 11, 2023 | In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow. | |||
| CVE-2023-2662 | 0.00 | — | 0.00 | May 11, 2023 | In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero. | |||
| CVE-2023-26930 | 0.00 | — | 0.00 | Apr 26, 2023 | Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.” | |||
| CVE-2022-45586 | 0.00 | — | 0.00 | Feb 15, 2023 | Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service. | |||
| CVE-2022-45587 | 0.00 | — | 0.00 | Feb 15, 2023 | Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service. | |||
| CVE-2021-36493 | 0.00 | — | 0.01 | Feb 3, 2023 | Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command. | |||
| CVE-2022-43071 | 0.00 | — | 0.00 | Nov 15, 2022 | A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. | |||
| CVE-2022-43295 | 0.00 | — | 0.00 | Nov 14, 2022 | XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795. |
- CVE-2024-7866Aug 15, 2024risk 0.00cvss —epss 0.00
In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow.
- CVE-2024-4976May 15, 2024risk 0.00cvss —epss 0.00
Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.
- CVE-2024-4568May 6, 2024risk 0.00cvss —epss 0.00
In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow.
- CVE-2024-4141Apr 24, 2024risk 0.00cvss —epss 0.00
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.
- CVE-2024-3900Apr 17, 2024risk 0.00cvss —epss 0.00
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.
- CVE-2024-3248Apr 2, 2024risk 0.00cvss —epss 0.00
In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.
- CVE-2024-3247Apr 2, 2024risk 0.00cvss —epss 0.00
In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow.
- CVE-2024-2971Mar 26, 2024risk 0.00cvss —epss 0.00
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference in the input PDF file.
- CVE-2022-48545Aug 22, 2023risk 0.00cvss —epss 0.00
An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
- CVE-2023-3436Jun 27, 2023risk 0.00cvss —epss 0.00
Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
- CVE-2023-3044Jun 2, 2023risk 0.00cvss —epss 0.00
An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large…
- CVE-2023-2664May 11, 2023risk 0.00cvss —epss 0.00
In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.
- CVE-2023-2663May 11, 2023risk 0.00cvss —epss 0.00
In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.
- CVE-2023-2662May 11, 2023risk 0.00cvss —epss 0.00
In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.
- CVE-2023-26930Apr 26, 2023risk 0.00cvss —epss 0.00
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”
- CVE-2022-45586Feb 15, 2023risk 0.00cvss —epss 0.00
Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.
- CVE-2022-45587Feb 15, 2023risk 0.00cvss —epss 0.00
Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.
- CVE-2021-36493Feb 3, 2023risk 0.00cvss —epss 0.01
Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.
- CVE-2022-43071Nov 15, 2022risk 0.00cvss —epss 0.00
A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
- CVE-2022-43295Nov 14, 2022risk 0.00cvss —epss 0.00
XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.
Page 3 of 9