CVE-2019-7310: canonical ubuntu_linux Out-of-bounds Read

Vulnerability summary

CVE-2019-7310 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 2.11% chance of exploitation in the next 30 days, higher than 81.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-02-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.