XpdfReader Xpdf any version

Stack overflow in Xpdf 4.04 due to object loop in PDF page label tree

Uninitialized variable in Xpdf 4.05 due to invalid JPEG header

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.

Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinates

XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.

Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file tree

Stack overflow in Xpdf 4.05 due to object loop in PDF object stream

Stack overflow in Xpdf 4.05 due to object loop in attachments

Divide-by-zero in Xpdf 4.04 due to bad color space object

Stack overflow in Xpdf 4.05 due to object loop in PDF resources

Stack overflow in Xpdf 4.05 due to object loop in PDF pattern

Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check

Out-of-bounds array access due to negative object numbers in indirect references in Xpdf 4.05

Out-of-bounds stack array write in Xpdf 4.05 due to missing zero check

Out-of-bounds array write in Xpdf 4.05 due to missing object type check

Divide-by-zero in Xpdf 4.04 due to very large page size