SB2024022639 - Multiple vulnerabilities in PDF-XChange Editor/Tools

Main Vulnerability Database SB2024022639

SB2024022639 - Multiple vulnerabilities in PDF-XChange Editor/Tools

Published: February 26, 2024

Security Bulletin ID SB2024022639

Severity

Medium

Patch available

YES

Number of vulnerabilities 10

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2024-27327)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the parsing of PDF files. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

2) Out-of-bounds read (CVE-ID: CVE-2024-27324)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of TIF files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

3) Out-of-bounds read (CVE-ID: CVE-2024-27332)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of JPG files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

4) Improper Certificate Validation (CVE-ID: CVE-2024-27323)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper certificate validation within the update functionality. A remote attacker on the local network can execute arbitrary code on the system.

5) Out-of-bounds read (CVE-ID: CVE-2024-27330)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of EMF files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

6) Out-of-bounds read (CVE-ID: CVE-2024-27329)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of XPS files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

7) Out-of-bounds read (CVE-ID: CVE-2024-27331)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of EMF files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

8) Out-of-bounds read (CVE-ID: CVE-2024-27328)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the handling of EMF files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

9) Out-of-bounds read (CVE-ID: CVE-2024-27325)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of EMF files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

10) Out-of-bounds read (CVE-ID: CVE-2024-27326)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the parsing of XPS files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

Remediation

Install update from vendor's website.

References