CVE-2019-5066: Use After Free

Published Sep 18, 2019

Updated

An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free condition. To trigger this vulnerability, a specifically crafted PDF document needs to be processed by the target application.

Affected Software

1 affected component

Aspose Aspose.pdf For C\+\+=19.2

Event History

Sep 18, 2019

CVE Published

via MITRE·08:16 PM

Data Sourced

via MITRE·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5066?

CVE-2019-5066 is classified as a critical vulnerability due to its potential for code execution through malformed PDF documents.

How do I fix CVE-2019-5066?

To mitigate CVE-2019-5066, upgrade Aspose.PDF for C++ to version 19.3 or later, which contains patches addressing this vulnerability.

What products are affected by CVE-2019-5066?

CVE-2019-5066 specifically affects Aspose.PDF version 19.2 for C++.

What type of attack can exploit CVE-2019-5066?

CVE-2019-5066 can be exploited by attackers using specially crafted PDF files to trigger the use-after-free condition.

What are the risks associated with CVE-2019-5066?

Exploitation of CVE-2019-5066 can lead to arbitrary code execution, allowing attackers to potentially gain control over affected systems.