CVE-2020-25725: Use After Free
In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState state) SplashOutputDev.cc:3079 is trying to use the freed t3GlyphStack->cache, which causes an heap-use-after-free problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/xpdfto a version that resolves this vulnerability.Fixed in 4.03-r0
Event History
Frequently Asked Questions
What is CVE-2020-25725?
CVE-2020-25725 is a vulnerability in Xpdf 4.02 that causes a heap-use-after-free problem.
What software is affected by CVE-2020-25725?
Xpdf 4.02 and Fedora 32 and 33 are affected by CVE-2020-25725.
What is the severity of CVE-2020-25725?
The severity of CVE-2020-25725 is medium with a score of 5.5.
How can I fix CVE-2020-25725?
Upgrade Xpdf to a version that has the fix, and apply the latest updates for Fedora.
Where can I find more information about CVE-2020-25725?
You can find more information about CVE-2020-25725 at the provided references.