CVE-2019-12957: fedoraproject fedora Out-of-bounds Read

Vulnerability summary

CVE-2019-12957 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-06-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.