CVE-2020-25725

Name
CVE-2020-25725
Description
In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25725
Exploit https://forum.xpdfreader.com/viewtopic.php?f=3&t=41915
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZUU5QG6SSVRTKZTR3A72LDRVZETEI63/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLOYVJSM54IL6I5RY4QTJGRS7PIEG44X/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZUU5QG6SSVRTKZTR3A72LDRVZETEI63/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLOYVJSM54IL6I5RY4QTJGRS7PIEG44X/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:xpdfreader:xpdf:4.02:*:*:*:*:*:*:* xpdf == None == 4.02

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
xpdf edge-community 4.03-r0 Isaac Dunham <ibid.ag@gmail.com> fixed
xpdf 3.22-community 4.03-r0 None fixed
xpdf 3.21-community 4.03-r0 None fixed
xpdf 3.20-community 4.03-r0 None fixed
xpdf 3.19-community 4.03-r0 None fixed
xpdf 3.18-community 4.03-r0 None fixed
xpdf 3.17-community 4.03-r0 None fixed