Libgxps
Monthly
Rendering a crafted XPS document drives GNOME libgxps through 0.3.2 (the renderer used by consumers such as Evince) into a heap out-of-bounds read inside path_geometry_start_element(), allowing an attacker to crash the consuming application and leak adjacent heap bytes into rendered output. The trigger is a PolyBezierSegment or PolyQuadraticBezierSegment Points attribute whose point count is not a multiple of three (bezier) or two (quadratic), so exploitation is limited to a local, file-based attack that requires the victim to open or render the malicious document via user interaction (CVSS 4.0 AV:L/UI:P, PR:N) with no authentication or privilege bypass, no code execution, and only low confidentiality impact alongside high availability impact. An independent assessment scores the flaw 6.9 (medium) using CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, and no public exploit identified at time of analysis despite a public technical writeup documenting the arity mismatch; the affected range is captured by the wildcard CPE cpe:2.3:a:gnome:libgxps:*:*:*:*:*:*:*:*.
There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Rendering a crafted XPS document drives GNOME libgxps through 0.3.2 (the renderer used by consumers such as Evince) into a heap out-of-bounds read inside path_geometry_start_element(), allowing an attacker to crash the consuming application and leak adjacent heap bytes into rendered output. The trigger is a PolyBezierSegment or PolyQuadraticBezierSegment Points attribute whose point count is not a multiple of three (bezier) or two (quadratic), so exploitation is limited to a local, file-based attack that requires the victim to open or render the malicious document via user interaction (CVSS 4.0 AV:L/UI:P, PR:N) with no authentication or privilege bypass, no code execution, and only low confidentiality impact alongside high availability impact. An independent assessment scores the flaw 6.9 (medium) using CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, and no public exploit identified at time of analysis despite a public technical writeup documenting the arity mismatch; the affected range is captured by the wildcard CPE cpe:2.3:a:gnome:libgxps:*:*:*:*:*:*:*:*.
There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.