CVE-2024-7868

CWE-457CWE-908 — Use of Uninitialized ResourceCWE-886 documents6 sources
Severity
2.1LOW
EPSS
0.3%
top 43.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Xpdfreader XpdfXpdf Xpdf
Timeline
PublishedAug 15
Latest updateDec 23

Description

In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDxpdfreader/xpdf< 4.06
▶CVEListV5xpdf/xpdf4.05

🔴Vulnerability Details

4
GHSA
Gogs has an argument Injection in the built-in SSH server↗2024-12-23
▶
CVEList
Uninitialized variable in Xpdf 4.05 due to invalid JPEG header↗2024-08-15
▶
GHSA
GHSA-x6qm-4c7w-8wm7: In Xpdf 4↗2024-08-15
▶
OSV
CVE-2024-7868: In Xpdf 4↗2024-08-15
▶

📋Vendor Advisories

1
Debian
CVE-2024-7868: xpdf - In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead ...↗2024
▶
CVE-2024-7868 (LOW CVSS 2.1) | In Xpdf 4.05 (and earlier) | cvebase.io