CVE-2019-9587: High severity glyph & cog xpdfreader vulnerability

Published Mar 6, 2019

Updated

There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.

Affected Software

1 affected component

Glyphandcog Xpdfreader=4.01

Event History

Mar 6, 2019

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Data Sourced

via NVD·08:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-9587?

CVE-2019-9587 has a severity rating that could lead to Denial of Service due to stack consumption issues.

How do I fix CVE-2019-9587?

To fix CVE-2019-9587, upgrade to the latest version of XpdfReader that addresses this vulnerability.

What does CVE-2019-9587 affect?

CVE-2019-9587 affects XpdfReader version 4.01, particularly its md5Round1() function.

What type of vulnerability is CVE-2019-9587?

CVE-2019-9587 is a stack consumption vulnerability that can lead to a segmentation fault.

How can an attacker exploit CVE-2019-9587?

An attacker can exploit CVE-2019-9587 by sending a crafted PDF file to the pdfimages binary.