CVE-2019-12957: Out-of-bounds Read
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-12957?
CVE-2019-12957 is a vulnerability in Xpdf 4.01.01 that allows a buffer over-read in the FoFiType1C::convertToType1 function.
How can the CVE-2019-12957 vulnerability be triggered?
The CVE-2019-12957 vulnerability can be triggered by sending a crafted PDF document to the pdftops tool.
Which software versions are affected by CVE-2019-12957?
Xpdf 4.01.01 is affected by the CVE-2019-12957 vulnerability.
What is the severity of CVE-2019-12957?
The severity of CVE-2019-12957 is high with a CVSS score of 7.8.
How can I fix the CVE-2019-12957 vulnerability?
To fix the CVE-2019-12957 vulnerability, update Xpdf to a version that is not affected.