CVE-2010-4653: Integer Overflow
An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.
Other sources
Dan Rosenberg reported an issue in xpdf/poppler code base:
http://thread.gmane.org/gmane.comp.security.oss.general/4109
Due to an integer overflow when parsing CharCodes for fonts and a failure to check the return value of a memory allocation, it is possible to trigger writes to a narrow range of offsets from a NULL pointer. The chance of being able to exploit this for anything other than a crash is very remote: on x86 32-bit, there's no chance (since the write occurs between 0xffffffc4 and 0xfffffffc). At least the write lands in valid userspace on x86-64, but in my testing this memory is never mapped.
poppler git commit that addresses integer overflow issue: http://cgit.freedesktop.org/poppler/poppler/commit/?id=cad66a7d25abdb6aa15f3aa94a35737b119b2659
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2010-4653?
CVE-2010-4653 is an integer overflow vulnerability in poppler before version 0.16.3.
How can an integer overflow occur in poppler?
An integer overflow can occur when parsing CharCodes for fonts in poppler.
What is the severity of CVE-2010-4653?
The severity of CVE-2010-4653 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2010-4653?
The affected software versions include poppler before 0.16.3, xpdf versions 3.04-13, 3.04+git20210103-3, and 3.04+git20220601-1.
How can I fix CVE-2010-4653?
To fix CVE-2010-4653, it is recommended to update to the patched versions of poppler and xpdf provided by the respective vendors.