The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (inf…
The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
https://cwe.mitre.org/data/definitions/674.html →Open in CWE collection →The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
https://cwe.mitre.org/data/definitions/835.html →Open in CWE collection →Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
https://capec.mitre.org/data/definitions/230.html →Open in CAPEC collection →An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.
https://capec.mitre.org/data/definitions/231.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| PackageKit | Tracked | |
| accountsservice | Tracked | |
| adwaita-icon-theme | Tracked | |
| appstream-data | Tracked | |
| at-spi2-atk | Tracked | |
| at-spi2-core | Tracked | |
| atk | Tracked | |
| baobab | Tracked | |
| bolt | Tracked | |
| brasero | Tracked | |
| cairo | Tracked | |
| cheese | Tracked | |
| clutter-gst3 | Tracked | |
| compat-exiv2-023 | Tracked | |
| control-center | Tracked | |
| dconf | Tracked | |
| dconf-editor | Tracked | |
| devhelp | Tracked | |
| ekiga | Tracked | |
| empathy | Tracked |