CVE-2019-9877: High severity xpdf vulnerability

Published Mar 19, 2019

Updated

There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Affected Software

1 affected component

Xpdfreader Xpdf=4.0.1

Event History

Mar 19, 2019

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

Description

Mar 21, 2019

Data Sourced

via NVD·04:01 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2019-9877?

CVE-2019-9877 is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01.

How can CVE-2019-9877 be triggered?

CVE-2019-9877 can be triggered by sending a crafted PDF file to the pdftops binary.

What is the impact of CVE-2019-9877?

The impact of CVE-2019-9877 is a Denial of Service (Segmentation fault) or possibly remote code execution.

Which software version is affected by CVE-2019-9877?

Xpdf 4.0.1 is the affected version of the software.

How can I fix CVE-2019-9877?

To fix CVE-2019-9877, update Xpdf to a version that is not affected, as recommended by the vendor.