CVE-2024-4976 - Out-of-bounds array write in Xpdf 4.05 due to missing object type check

Back Back to CVE browser

LOW

Out-of-bounds array write in Xpdf 4.05 due to missing object type check

Published May 15, 2024

2.1

LOW

CVSS 4.0

EPSS 0.17%

Description

Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.

Affected products

Vendor Xpdf Product Xpdf Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=4.05

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xpdf

unaffected

Version	Status	Constraints
0	affected	<=4.05

Vendor Xpdf Product Xpdf Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=4.05

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xpdf

n/a

Version	Status	Constraints
0	affected	<=4.05

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	xpdf	Will not fix	n/a

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (6)

https://access.redhat.com/security/cve/CVE-2024-4976
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2280759
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44533
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4976
https://www.cve.org/CVERecord?id=CVE-2024-4976
https://www.xpdfreader.com/security-bug/CVE-2024-4976.html
Vendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-4976		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2280759		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44533		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4976
https://www.cve.org/CVERecord?id=CVE-2024-4976
https://www.xpdfreader.com/security-bug/CVE-2024-4976.html		Vendor Advisory