Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2019-14934 |
CWE-ID | CWE-787 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
PDFResurrect Client/Desktop applications / Other client software |
Vendor | Matt Davis |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU30825
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-14934
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local non-authenticated attacker to execute arbitrary code.
An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write.
MitigationInstall update from vendor's website.
Vulnerable software versionsPDFResurrect: 0.12 - 0.17
External linkshttp://github.com/enferex/pdfresurrect/commit/0c4120fffa3dffe97b95c486a120eded82afe8a6
http://github.com/enferex/pdfresurrect/compare/v0.17...v0.18
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBYXYU2VSDJ3NAL54IW2KYD3TZSR33M/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXN6W5QTNQJ2LFDCQWKYSMMZ3NPUWP3U/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y243C2IFMRFQWHV62JCSHTMQGDDCICNF/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.