CVE-2023-26930

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26930
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/huanglei3/10e2a9bd07a109995b20ade306612a34 Third Party Advisory
https://github.com/huanglei3/xpdf_aborted Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:xpdfreader:xpdf:4.04:*:*:*:*:*:*:*
History

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary ** DISPUTED ** Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.” Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”

02 Jun 2023, 14:15

Type Values Removed Values Added
Summary Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. ** DISPUTED ** Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”

03 May 2023, 16:49

Type Values Removed Values Added
References (MISC) https://gist.github.com/huanglei3/10e2a9bd07a109995b20ade306612a34 - (MISC) https://gist.github.com/huanglei3/10e2a9bd07a109995b20ade306612a34 - Third Party Advisory
References (MISC) https://github.com/huanglei3/xpdf_aborted - (MISC) https://github.com/huanglei3/xpdf_aborted - Exploit
First Time Xpdfreader
Xpdfreader xpdf
CWE CWE-120
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:a:xpdfreader:xpdf:4.04:*:*:*:*:*:*:*

26 Apr 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-26 19:15

Updated : 2024-04-11 01:19

NVD link : CVE-2023-26930

Mitre link : CVE-2023-26930

CVE.ORG link : CVE-2023-26930

JSON object : View

Products Affected

xpdfreader

  • xpdf
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')