Homepage

Out-of-bounds Write The advisory has been revoked - it doesn't affect any version of package ipe  (opens in a new tab)

Threat Intelligence

EPSS
1.21% (65th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1804-IPE-643318
  • published10 Sept 2020
  • disclosed4 Jul 2019
Report a new vulnerability Found a mistake?

Introduced: 4 Jul 2019

CVE-2019-13281  (opens in a new tab)
CWE-787  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ipe package and not the ipe package as distributed by Ubuntu.

In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service, an information leak, or possibly unspecified other impact.

References