REDHAT-BUG-672165: Integer Overflow

First published: Mon Jan 24 2011(Updated: )

Dan Rosenberg reported an issue in xpdf/poppler code base: <a href="http://thread.gmane.org/gmane.comp.security.oss.general/4109">http://thread.gmane.org/gmane.comp.security.oss.general/4109</a> Due to an integer overflow when parsing CharCodes for fonts and a failure to check the return value of a memory allocation, it is possible to trigger writes to a narrow range of offsets from a NULL pointer. The chance of being able to exploit this for anything other than a crash is very remote: on x86 32-bit, there's no chance (since the write occurs between 0xffffffc4 and 0xfffffffc). At least the write lands in valid userspace on x86-64, but in my testing this memory is never mapped. poppler git commit that addresses integer overflow issue: <a href="http://cgit.freedesktop.org/poppler/poppler/commit/?id=cad66a7d25abdb6aa15f3aa94a35737b119b2659">http://cgit.freedesktop.org/poppler/poppler/commit/?id=cad66a7d25abdb6aa15f3aa94a35737b119b2659</a> Acknowledgements: Red Hat would like to thank Dan Rosenberg for reporting this issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2010-4653
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• agent/severity
• agent/weakness
• agent/description
• agent/references
• agent/event
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/freedesktop
• canonical/poppler utilities
• vendor/xpdf
• canonical/xpdf