CVE-2022-27135

Name
CVE-2022-27135
Description
xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified effects by sending a crafted PDF file to the pdftoppm binary.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/verf1sh/Poc/blob/master/poc_ppm
MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=42232
MISC https://github.com/verf1sh/Poc/blob/master/pic_ppm.png

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:xpdfreader:xpdf:4.03:*:*:*:*:*:*:* xpdf == None == 4.03

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
xpdf 3.15-community 4.03-r0 None possibly vulnerable