Vulnerability Details : CVE-2011-0764
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.
Vulnerability category: Input validationExecute code
Exploit prediction scoring system (EPSS) score for CVE-2011-0764
Probability of exploitation activity in the next 30 days: 27.82%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-0764
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2011-0764
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-0764
-
http://www.kb.cert.org/vuls/id/376500
VU#376500 - Foolabs Xpdf contains a denial of service vulnerabilityUS Government Resource
-
http://www.vupen.com/english/advisories/2011/0728
Webmail | OVH- OVHVendor Advisory
-
http://www.securityfocus.com/archive/1/517205/100/0/threaded
SecurityFocus
-
http://securityreason.com/securityalert/8171
xpdf multiple vulnerabilities allow remote code execution - CXSecurity.com
-
https://security.gentoo.org/glsa/201701-57
T1Lib: : Multiple vulnerabilities (GLSA 201701-57) — Gentoo security
-
http://www.foolabs.com/xpdf/download.html
Download Xpdf and XpdfReaderPatch
-
http://rhn.redhat.com/errata/RHSA-2012-1201.html
RHSA-2012:1201 - Security Advisory - Red Hat Customer Portal
- http://www.toucan-system.com/advisories/tssa-2011-01.txt
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:144
mandriva.com
-
http://securitytracker.com/id?1025266
Xpdf Memory Corruption Errors in t1lib Library Let Remote Users Execute Arbitrary Code - SecurityTracker
-
http://www.ubuntu.com/usn/USN-1316-1
USN-1316-1: t1lib vulnerability | Ubuntu security notices
-
http://www.securityfocus.com/bid/46941
t1lib Type 1 Font Parsing Remote Code Execution Vulnerability
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:002
mandriva.com
-
http://www.kb.cert.org/vuls/id/MAPG-8ECL8X
VU#376500 - Foolabs Xpdf contains a denial of service vulnerabilityUS Government Resource
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/66208
Xpdf t1lib code execution CVE-2011-0764 Vulnerability Report
Products affected by CVE-2011-0764
- cpe:2.3:a:t1lib:t1lib:*:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.6:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.7:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.3:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.1:alpha:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.8:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.93b:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.93a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.91c:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.5a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.93c:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92b:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.7a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92e:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.91b:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.91a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:1.00a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92d:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92c:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.02pl2:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.02pl1:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.02pl3:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.02pl4:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:*:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:3.01:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:2.03:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:2.02:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.92:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:3.00:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:1.00:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.80:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:2.01:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:2.00:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.93:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:1.01:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.91:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.90:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:glyphandcog:xpdfreader:3.02:*:*:*:*:*:*:*