CVE-2016-8875 — Out-of-bounds Read in Phantompdf

CWE-125 — Out-of-bounds Read4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 74.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Foxitsoftware PhantompdfFoxitsoftware Reader
Timeline
PublishedOct 31
Latest updateMay 17

Description

The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image, aka "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at ConvertToPDF_x86!CreateFXPDFConvertor."

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.6 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: www.foxitsoftware.com ↗Patch: www.foxitsoftware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-22hq-4pp4-cw6m: The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8↗2022-05-17
▶
CVEList
CVE-2016-8875: The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8↗2016-10-31
▶

💬Community

1
Bugzilla
CVE-2015-8875 gdk-pixbuf: Integer overflows in various pixops functions↗2016-05-18
▶
CVE-2016-8875 — Out-of-bounds Read in Phantompdf | cvebase