CVE-2011-1554 Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document cont...
MediumCVSS 4.3
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| t1lib | <= 5.1.2 | No fix listed |
| t1lib | = 0.1-alpha | No fix listed |
| t1lib | = 0.2-beta | No fix listed |
| t1lib | = 0.3-beta | No fix listed |
| t1lib | = 0.4-beta | No fix listed |
| t1lib | = 0.5-beta | No fix listed |
| t1lib | = 0.6-beta | No fix listed |
| t1lib | = 0.7-beta | No fix listed |
| t1lib | = 0.8-beta | No fix listed |
| t1lib | = 0.9 | No fix listed |
| t1lib | = 0.9.1 | No fix listed |
| t1lib | = 0.9.2 | No fix listed |
| t1lib | = 1.0 | No fix listed |
| t1lib | = 1.0.1 | No fix listed |
| t1lib | = 1.1.0 | No fix listed |
| t1lib | = 1.1.1 | No fix listed |
| t1lib | = 1.2 | No fix listed |
| t1lib | = 1.3 | No fix listed |
| t1lib | = 1.3.1 | No fix listed |
| t1lib | = 5.0.0 | No fix listed |
| t1lib | = 5.0.1 | No fix listed |
| t1lib | = 5.0.2 | No fix listed |
| t1lib | = 5.1.0 | No fix listed |
| t1lib | = 5.1.1 | No fix listed |
| foolabs xpdf | = 0.5a | No fix listed |
Show 42 more
| Product | Affected versions | Fixed in |
|---|---|---|
| foolabs xpdf | = 0.7a | No fix listed |
| foolabs xpdf | = 0.91a | No fix listed |
| foolabs xpdf | = 0.91b | No fix listed |
| foolabs xpdf | = 0.91c | No fix listed |
| foolabs xpdf | = 0.92a | No fix listed |
| foolabs xpdf | = 0.92b | No fix listed |
| foolabs xpdf | = 0.92c | No fix listed |
| foolabs xpdf | = 0.92d | No fix listed |
| foolabs xpdf | = 0.92e | No fix listed |
| foolabs xpdf | = 0.93a | No fix listed |
| foolabs xpdf | = 0.93b | No fix listed |
| foolabs xpdf | = 0.93c | No fix listed |
| foolabs xpdf | = 1.00a | No fix listed |
| foolabs xpdf | = 3.0.1 | No fix listed |
| foolabs xpdf | = 3.02pl1 | No fix listed |
| foolabs xpdf | = 3.02pl2 | No fix listed |
| foolabs xpdf | = 3.02pl3 | No fix listed |
| foolabs xpdf | = 3.02pl4 | No fix listed |
| glyphandcog xpdfreader | <= 3.02 | No fix listed |
| glyphandcog xpdfreader | = 0.2 | No fix listed |
| glyphandcog xpdfreader | = 0.3 | No fix listed |
| glyphandcog xpdfreader | = 0.4 | No fix listed |
| glyphandcog xpdfreader | = 0.5 | No fix listed |
| glyphandcog xpdfreader | = 0.6 | No fix listed |
| glyphandcog xpdfreader | = 0.7 | No fix listed |
| glyphandcog xpdfreader | = 0.80 | No fix listed |
| glyphandcog xpdfreader | = 0.90 | No fix listed |
| glyphandcog xpdfreader | = 0.91 | No fix listed |
| glyphandcog xpdfreader | = 0.92 | No fix listed |
| glyphandcog xpdfreader | = 0.93 | No fix listed |
| glyphandcog xpdfreader | = 1.00 | No fix listed |
| glyphandcog xpdfreader | = 1.01 | No fix listed |
| glyphandcog xpdfreader | = 2.00 | No fix listed |
| glyphandcog xpdfreader | = 2.01 | No fix listed |
| glyphandcog xpdfreader | = 2.02 | No fix listed |
| glyphandcog xpdfreader | = 2.03 | No fix listed |
| glyphandcog xpdfreader | = 3.00 | No fix listed |
| glyphandcog xpdfreader | = 3.01 | No fix listed |
| glyphandcog xpdfreader | = 3.02 | No fix listed |
| debian/xpdf(Debian:12) | < 3.02-9 | 3.02-9 |
| debian/xpdf(Debian:13) | < 3.02-9 | 3.02-9 |
| debian/xpdf(Debian:14) | < 3.02-9 | 3.02-9 |
References
- RHSA-2012:1201 vendor-advisory
- 43823 third-party-advisory vendor-advisory
- 48985 third-party-advisory
- 8171 third-party-advisory
- 1025266 vdb-entry
- www.foolabs.com patch
- VU#376500 third-party-advisory us-government-resource
- www.kb.cert.org us-government-resource
- MDVSA-2012:144 vendor-advisory
- 20110327 TSSA-2011-01 xpdf : multiple vulnerabilities allow remote code execution mailing-list
- www.toucan-system.com
- ADV-2011-0728 vdb-entry vendor-advisory
- GLSA-201701-57 vendor-advisory
- Debian Security Tracker CVE-2011-1554 vendor-advisory