CVE-2019-5854: Integer overflow in PDFium text rendering
Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Who is exposed to this issue?
Users of Google Chrome versions earlier than 76.0.3809.87 are affected. The listed software also includes Debian Chromium.
What does exploitation require?
An attacker needs to provide a crafted PDF file and persuade a user to interact with it. The vector is network-based and does not require attacker privileges.
What could successful exploitation cause?
The integer overflow could lead to heap corruption. The reported impact includes high confidentiality, integrity, and availability impact.