CVE-2018-8106

CWE-125 — Out-of-bounds Read8 documents6 sources

Severity

5.5MEDIUM

EPSS

0.1%

top 66.48%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Xpdfreader Xpdf

Timeline

PublishedMar 14

Latest updateMay 13

Description

The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages1 packages

▶NVDxpdfreader/xpdf4.00

🔴Vulnerability Details

GHSA

GHSA-7xxg-7678-587v: The JPXStream::readTilePartData function in JPXStream↗2022-05-13

▶

CVEList

CVE-2018-8106: The JPXStream::readTilePartData function in JPXStream↗2018-03-14

▶

OSV

CVE-2018-8106: The JPXStream::readTilePartData function in JPXStream↗2018-03-14

▶

📋Vendor Advisories

Debian

CVE-2018-8106: xpdf - The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows att...↗2018

▶

💬Community

Bugzilla

CVE-2018-8100 CVE-2018-8101 CVE-2018-8102 CVE-2018-8103 CVE-2018-8104 CVE-2018-8105 CVE-2018-8106 CVE-2018-8107 xpdf: Multiple buffer overflow vulnerabilities↗2018-03-21

▶

Bugzilla

CVE-2018-8100 CVE-2018-8101 CVE-2018-8102 CVE-2018-8103 CVE-2018-8104 CVE-2018-8105 CVE-2018-8106 CVE-2018-8107 xpdf: Multiple buffer overflow problems [fedora-all]↗2018-03-21

▶

Bugzilla

CVE-2018-8100 CVE-2018-8101 CVE-2018-8102 CVE-2018-8103 CVE-2018-8104 CVE-2018-8105 CVE-2018-8106 CVE-2018-8107 xpdf: Multiple buffer overflow problems [epel-all]↗2018-03-21

▶