CVE-2019-13291
First published: Thu Jul 04 2019(Updated: )
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Information Disclosure.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Glyphandcog Xpdfreader | =4.01.01 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-13291?
The severity of CVE-2019-13291 is rated as medium (5.5).
How can I trigger the vulnerability in Xpdf 4.01.01?
The vulnerability in Xpdf 4.01.01 can be triggered by sending a crafted PDF document to the pdftops tool.
Where is the heap-based buffer over-read located in Xpdf 4.01.01?
In Xpdf 4.01.01, the heap-based buffer over-read is located in the function DCTStream::readScan() at Stream.cc.
What type of attack does CVE-2019-13291 make possible?
CVE-2019-13291 might allow an attacker to cause Information Disclosure.
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/author
- agent/tags
- agent/type
- agent/event
- vendor/glyphandcog
- canonical/glyphandcog xpdfreader
- version/glyphandcog xpdfreader/4.01.01