Xpdfreader vulnerabilities
We track 4 vulnerabilities in Xpdfreader products. 4 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 29, 2022.
Latest Xpdfreader vulnerabilities
- 7.8 High severity
Xpdf: Use After Free
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecifi
- 7.8 High severity
Xpdf: Integer Overflow or Wraparound
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar
- 7.8 High severity
Xpdf: Out-of-bounds Write
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which al
- 7.8 High severity
Apple Multiple Products Integer Overflow Exploited
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution.