In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a     stack overflow. (CVE-2023-2664)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of
    object.cc files. (CVE-2022-33108)

  - There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text
    extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a
    crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service
    (Segmentation fault) or possibly have unspecified other impact. (CVE-2022-30524)

  - xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for
    example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the
    DCMAKE_CXX_COMPILER=afl-clang-fast++ option. (CVE-2022-30775)

  - XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
    (CVE-2022-36561)

The remote host is affected by the vulnerability described in GLSA-202409-25 (Xpdf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Xpdf. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of xpdf installed on the remote host is prior to 4.05. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-040-01 advisory.

  - XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack     consumption) via a crafted pdf file, related to AcroForm::scanField, as demonstrated by pdftohtml. NOTE:
    this might overlap CVE-2018-7453. (CVE-2018-16369)

  - Infinite recursion in AcroForm::scanField in AcroForm.cc in xpdf 4.00 allows attackers to launch denial of     service via a specific pdf file due to lack of loop checking, as demonstrated by pdftohtml.
    (CVE-2018-7453)

  - XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
    (CVE-2022-36561)

  - An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in     xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088. (CVE-2022-41844)

  - In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.
    (CVE-2023-2662)

  - In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a     stack overflow. (CVE-2023-2663)

  - In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a     stack overflow. (CVE-2023-2664)

  - An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a     divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is     caused by a very large page size, rather than by a very large character coordinate. (CVE-2023-3044)

  - Xpdf 4.04 will deadlock on a PDF object stream whose Length field is itself in another object stream.
    (CVE-2023-3436)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257775	Linux Distros Unpatched Vulnerability : CVE-2023-2664	Nessus	Misc.	medium
427694	Alpine: multiple xpdf packages: security update to 4.05-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427694	Alpine: multiple xpdf packages: security update to 4.05-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
207721	GLSA-202409-25 : Xpdf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
190377	Slackware Linux 15.0 / current xpdf Multiple Vulnerabilities (SSA:2024-040-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2023-2664

medium

Tenable Plugins

medium

high

high

high

medium