CVE-2019-13288

published 2019-07-04

CVE-2019-13288: In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS…

medium 5.5 CVSS 3.0

AV L AC L PR N UI R S U C N I N A H

In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	xpdf	—	—
freedesktop	poppler	>= 0 < 0.41.0-0ubuntu1.14	0.41.0-0ubuntu1.14
freedesktop	poppler	>= 0 < 0.62.0-2ubuntu2.9	0.62.0-2ubuntu2.9
glyphandcog	xpdfreader	—	—

CVSS provenance

nvd v3.0 5.5 MEDIUM CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

osv 6.5 MEDIUM