CVE-2019-9878: pdfalto_project pdfalto Out-of-bounds Read
Vulnerability summary
CVE-2019-9878 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in pdfalto_project pdfalto. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.20% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (research.loginsoft.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Pdfalto_project1 product
- pdfalto0.2
Ubuntu1 product
- poppler< 0.41.0-0ubuntu1.13 | < 0.62.0-2ubuntu2.8
Xpdfreader1 product
- xpdf4.0.0
3 vendors · 3 products
References
4 links- research.loginsoft.com/bugs/invalid-memory-access-in-gfxindexedcolorspacemapcolortobase-pdfalto-0-2/X Refsource MISCREPORTExploitThird Party Advisory