CVE-2020-24999: High severity xpdf vulnerability
There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Xpdf issue?
The vulnerability ID for this Xpdf issue is CVE-2020-24999.
Where is the invalid memory access located?
The invalid memory access is located in the function fprintf in Error.cc in Xpdf 4.0.2.
How can the vulnerability be triggered?
The vulnerability can be triggered by sending a crafted PDF file to the pdftohtml binary.
What are the potential impacts of this vulnerability?
The potential impacts of this vulnerability include a Denial of Service (Segmentation fault) or possibly unspecified other impacts.
What is the severity of CVE-2020-24999?
The severity of CVE-2020-24999 is high with a CVSS score of 7.8.
How can I fix this vulnerability?
To fix this vulnerability, update Xpdf to version 4.0.3 or later.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following link: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42029.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-787.