Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.

Threat-Mapped Scoring

Score: 1.9

Priority: P3 - Important (Medium)

• S9 – Sabotage of System/App
• S10 – Denial of Service (+0.1 bonus)

EPSS

Score: 0.10502
Percentile: 0.92905

CVSS Scoring

Affected Products

• cpe:2.3:a:xpdf:xpdf:0.2:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.3:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.4:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.5:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.5a:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.6:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.7:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.7a:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.80:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.90:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.91:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.91a:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.91b:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.91c:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.92:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.92a:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.92b:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.92c:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.92d:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.92e:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.93:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.93a:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.93b:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:0.93c:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:1.0a:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:1.1:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:2.1:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:2.2:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:2.3:*:*:*:*:*:*:*
• cpe:2.3:a:xpdf:xpdf:3.0:*:*:*:*:*:*:*

← Back to Home