CVE-2022-27135

xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified effects by sending a crafted PDF file to the pdftoppm binary.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42232	Exploit Third Party Advisory
https://github.com/verf1sh/Poc/blob/master/pic_ppm.png	Third Party Advisory
https://github.com/verf1sh/Poc/blob/master/poc_ppm	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xpdfreader:xpdf:4.03:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-04-25 13:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-27135

Mitre link : CVE-2022-27135

CVE.ORG link : CVE-2022-27135

JSON object : View

Products Affected

xpdfreader

xpdf

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-27135", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-04-25T13:15:49.427", "references": [{"url": "https://forum.xpdfreader.com/viewtopic.php?f=3&t=42232", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/verf1sh/Poc/blob/master/pic_ppm.png", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/verf1sh/Poc/blob/master/poc_ppm", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified effects by sending a crafted PDF file to the pdftoppm binary."}, {"lang": "es", "value": "xpdf versi\u00f3n 4.03, presenta un desbordamiento del b\u00fafer de la pila en la funci\u00f3n readXRefTable ubicada en el archivo XRef.cc. Un atacante puede explotar este bug para causar una denegaci\u00f3n de servicio (fallo de segmentaci\u00f3n) u otros efectos no especificados mediante el env\u00edo de un archivo PDF dise\u00f1ado al binario pdftoppm"}], "lastModified": "2022-05-05T14:08:03.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xpdfreader:xpdf:4.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67869B50-18C4-4F9D-8567-FBF97E4EFE10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}