CVE-2019-13283: High severity glyph & cog xpdfreader vulnerability
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-13283.
What is the severity of CVE-2019-13283?
The severity of CVE-2019-13283 is high with a score of 7.8.
How can this vulnerability be triggered?
This vulnerability can be triggered by sending a crafted PDF document to the pdftot tool.
Which software versions are affected by CVE-2019-13283?
Xpdfreader 4.01.01 and Fedora 29, 30, and 31 are affected by CVE-2019-13283.
Is there a fix available for this vulnerability?
Yes, a fix is available for this vulnerability. It is recommended to update to the latest version of Xpdfreader (4.01.02 or later) or Fedora (32 or later).