CVE-2019-13283
Fixed in a distro release EPSS 1%
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Products: glyphandcog xpdfreader, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | poppler | 0.62.0-150000.4.9.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | poppler-qt | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | poppler-qt | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | poppler-qt | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP5 | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 12 SP5 | poppler-qt | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | poppler | 0.62.0-150000.4.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | poppler-qt | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | poppler-qt | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | poppler | 0.62.0-150000.4.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | poppler | 0.43.0-16.22.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | poppler | 0.24.4-14.23.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | poppler-qt | 0.43.0-16.22.1 |
| SUSE OpenStack Cloud 9 | poppler | 0.43.0-16.22.1 |
| SUSE OpenStack Cloud 9 | poppler-qt | 0.43.0-16.22.1 |
| SUSE OpenStack Cloud Crowbar 9 | poppler | 0.43.0-16.22.1 |
| SUSE OpenStack Cloud Crowbar 9 | poppler-qt | 0.43.0-16.22.1 |
| Ubuntu 16.04 LTS | poppler | 0.41.0-0ubuntu1.15 |
| Ubuntu 18.04 LTS | poppler | 0.62.0-2ubuntu2.11 |
| openSUSE Leap 15.4 | poppler | 0.62.0-150000.4.9.1 |