What is CVE-2019-5019?

CVE-2019-5019 is a critical-severity vulnerability in Rainbowpdf Office Server Document Converter, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2019-03-07.

How severe is CVE-2019-5019?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Rainbowpdf Office Server Document Converter

CVE-2019-5019

A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018,1113). While parsing Document Summary Property Set stream, the getSummaryInformation function is incorrectly checking the correlation between size and the number of properties in PropertySet packets, causing an out-of-bounds write that leads to heap corruption and consequent code execution.

Vulnerability class: Buffer Overflow

EPSS: 0.023 (81.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Rainbowpdf Office_server_document_converter — versions 7.0
N/a Antenna House — versions Antenna House Rainbow PDF Office Server Document Converter v7.0 Pro R1 for Linux64 (7,0,2018,1113)

Weakness classification (CWE)

References

talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-5019?: CVE-2019-5019 is a critical-severity vulnerability in Rainbowpdf Office Server Document Converter, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2019-03-07.
How severe is CVE-2019-5019?: Critical severity. CVSS v3 base score is 9.8 out of 10.