Improper input validation in Poppler
CVE-2008-1693
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.049 (91.3th percentile) — read the EPSS interpretation.
Affected products
- Poppler — versions 0.1, 0.1.1, 0.1.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@ubuntu.com (x_refsource_SECUNIA, third-party-advisory)
- security@ubuntu.com (vendor-advisory, x_refsource_SUSE)
- security@ubuntu.com (vendor-advisory, x_refsource_MANDRIVA)
- security@ubuntu.com (signature, x_refsource_OVAL, vdb-entry)
- security@ubuntu.com (vdb-entry, x_refsource_VUPEN)
- security@ubuntu.com (vendor-advisory, x_refsource_MANDRIVA)
- security@ubuntu.com (x_refsource_SECUNIA, third-party-advisory)
- security@ubuntu.com (x_refsource_SECUNIA, third-party-advisory)
- security@ubuntu.com (x_refsource_SECUNIA, third-party-advisory)
- security@ubuntu.com (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2008-1693?
- CVE-2008-1693 is a vulnerability in Poppler, classified under Improper Input Validation. Published 2008-04-18.
- Is CVE-2008-1693 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.