What is CVE-2019-9587?

CVE-2019-9587 is a high-severity vulnerability in Glyphandcog Xpdfreader, classified under Uncontrolled Resource Consumption. CVSS score: 7.8/10. Published 2019-03-06.

How severe is CVE-2019-9587?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2019-9587 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Glyphandcog Xpdfreader

CVE-2019-9587

There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.012 (64.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Glyphandcog Xpdfreader — versions 4.01
N/a — versions n/a

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-9587?: CVE-2019-9587 is a high-severity vulnerability in Glyphandcog Xpdfreader, classified under Uncontrolled Resource Consumption. CVSS score: 7.8/10. Published 2019-03-06.
How severe is CVE-2019-9587?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2019-9587 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.