CVE-2021-31504: OpenText Brava! Desktop PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12691.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31504?
CVE-2021-31504 has a critical severity rating due to the potential for remote code execution.
How do I fix CVE-2021-31504?
To fix CVE-2021-31504, update OpenText Brava! Desktop to the latest version provided by OpenText.
What are the requirements to exploit CVE-2021-31504?
Exploitation of CVE-2021-31504 requires user interaction, such as visiting a malicious webpage or opening a malicious file.
Which versions of OpenText Brava! Desktop are affected by CVE-2021-31504?
CVE-2021-31504 affects OpenText Brava! Desktop version 16.6.3.84.
Who is at risk from CVE-2021-31504?
Users and organizations running the affected version of OpenText Brava! Desktop are at risk from CVE-2021-31504.