Xpdf CVE-2024-7866

LOW

Uncontrolled Recursion (CWE-674)

2024-08-15 xpdf@xpdfreader.com

Buffer Overflow Xpdf

2.1

CVSS 4.0 · Vendor: xpdfreader

Severity by source

Vendor (xpdfreader) PRIMARY

2.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (xpdfreader) · only source for this CVE.

CVSS VectorVendor: xpdfreader

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

X

Lifecycle Timeline

1

CVE Published

Aug 15, 2024 - 20:15 cve.org

LOW 2.1

DescriptionCVE.org

In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow.

AnalysisAI

In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. Rated low severity (CVSS 2.1), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-674. In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. Affected products include: Xpdfreader Xpdf.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Xpdf

View all

CVE-2022-38222 HIGH This Week POC

There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. Rated high severity (CVS

CVE-2022-38928 HIGH This Week POC

XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393. Rated high severity (CVSS 7.8), this vulnerab

CVE-2022-38238 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc. Rated

CVE-2022-38237 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc. Rated

CVE-2022-38236 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc. Rat

CVE-2022-38231 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.cc. Rated

CVE-2022-38229 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/

CVE-2022-38228 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc

CVE-2022-38227 HIGH This Week POC

XPDF commit ffaf11c was discovered to contain a stack overflow via __asan_memcpy at asan_interceptors_memintrinsics.cpp.

CVE-2022-33108 HIGH This Week POC

XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files. Rated

CVE-2022-30524 HIGH This Week POC

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mis

CVE-2020-24999 HIGH This Week POC

There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. Rated high severity (CVSS 7

Same weakness CWE-674 – Uncontrolled Recursion

View all

CVE-2019-9545 HIGH POC

CVE-2019-9543 HIGH POC

CVE-2019-9144 HIGH POC

CVE-2019-9143 HIGH POC

CVE-2025-9624 HIGH POC

CVE-2021-28210 HIGH POC

CVE-2018-9918 HIGH POC

CVE-2025-57809 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2017-11882 HIGH POC

CVE-2010-3333 HIGH POC

Share

CVE-2024-7866 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy