CVE-2019-12493: High severity glyph & cog xpdfreader vulnerability

Published May 31, 2019

Updated

A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data.

Affected Software

1 affected component

Glyphandcog Xpdfreader=4.01.01

Event History

May 31, 2019

CVE Published

via MITRE·01:12 AM

Data Sourced

via MITRE·01:12 AM

Description

Frequently Asked Questions

What is CVE-2019-12493?

CVE-2019-12493 is a vulnerability in Xpdf 4.01.01 that allows for a stack-based buffer over-read.

How does the vulnerability in Xpdf 4.01.01 occur?

The vulnerability occurs in PostScriptFunction::transform in Function.cc because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions.

What is the severity of CVE-2019-12493?

The severity of CVE-2019-12493 is high with a CVSS score of 7.1.

Which software versions are affected by CVE-2019-12493?

Xpdfreader version 4.01.01 (and possibly earlier versions) is affected by CVE-2019-12493.

How can the CVE-2019-12493 vulnerability be triggered?

The vulnerability can be triggered by sending a crafted PDF document to the pdftops tool.