Published: 31/03/2011 Updated: 06/03/2019

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

t1lib 5.1.2 and previous versions, as used in Xpdf prior to 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote malicious users to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

Vulnerable Product	Search on Vulmon	Subscribe to Product
t1lib t1lib 5.0.2
t1lib t1lib 5.0.1
t1lib t1lib 0.6
t1lib t1lib 0.7
t1lib t1lib 1.1.1
t1lib t1lib 1.2
t1lib t1lib 0.2
t1lib t1lib 0.3
t1lib t1lib 0.9.1
t1lib t1lib 0.9.2
t1lib t1lib
t1lib t1lib 5.0.0
t1lib t1lib 0.1
t1lib t1lib 0.8
t1lib t1lib 0.9
t1lib t1lib 1.3
t1lib t1lib 1.3.1
t1lib t1lib 5.1.1
t1lib t1lib 5.1.0
t1lib t1lib 0.4
t1lib t1lib 0.5
t1lib t1lib 1.0
t1lib t1lib 1.0.1
t1lib t1lib 1.1.0
glyphandcog xpdfreader 0.80
foolabs xpdf 0.7a
foolabs xpdf 3.02pl4
glyphandcog xpdfreader 0.3
glyphandcog xpdfreader 0.91
foolabs xpdf 0.91c
glyphandcog xpdfreader 0.6
foolabs xpdf 0.5a
glyphandcog xpdfreader 0.5
foolabs xpdf 3.02pl1
glyphandcog xpdfreader 2.03
foolabs xpdf 0.93a
foolabs xpdf 0.93b
glyphandcog xpdfreader
glyphandcog xpdfreader 3.01
glyphandcog xpdfreader 0.92
glyphandcog xpdfreader 0.2
glyphandcog xpdfreader 0.7
foolabs xpdf 1.00a
glyphandcog xpdfreader 2.02
foolabs xpdf 0.92a
foolabs xpdf 0.92b
foolabs xpdf 3.02pl2
foolabs xpdf 3.0.1
foolabs xpdf 3.02pl3
foolabs xpdf 0.93c
foolabs xpdf 0.92c
foolabs xpdf 0.92d
glyphandcog xpdfreader 3.02
glyphandcog xpdfreader 3.00
foolabs xpdf 0.91a
glyphandcog xpdfreader 0.90
foolabs xpdf 0.91b
glyphandcog xpdfreader 0.4
glyphandcog xpdfreader 1.00
glyphandcog xpdfreader 1.01
glyphandcog xpdfreader 2.00
glyphandcog xpdfreader 2.01
foolabs xpdf 0.92e
glyphandcog xpdfreader 0.93

t1lib could be made to crash or run programs as your login if it opened a specially crafted font file ...

Synopsis Moderate: t1lib security update Type/Severity Security Advisory: Moderate Topic Updated t1lib packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability S ...

Synopsis Moderate: texlive security update Type/Severity Security Advisory: Moderate Topic Updated texlive packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerabili ...

Synopsis Moderate: tetex security update Type/Severity Security Advisory: Moderate Topic Updated tetex packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability S ...

Several vulnerabilities were discovered in t1lib, a Postscript Type 1 font rasterizer library, some of which might lead to code execution through the opening of files embedding bad fonts CVE-2010-2642 A heap-based buffer overflow in the AFM font metrics parser potentially leads to the execution of arbitrary code CVE-2011-0433 Another heap-bas ...

TeX Live embeds a copy of t1lib The t1lib library allows you to rasterize bitmaps from PostScript Type 1 fonts The following issues affect t1lib code: Two heap-based buffer overflow flaws were found in the way t1lib processed Adobe Font Metrics (AFM) files If a specially-crafted font file was opened by a TeX Live utility, it could cause the util ...

Two heap-based buffer overflow flaws were found in the way t1lib processed Adobe Font Metrics (AFM) files If a specially-crafted font file was opened by an application linked against t1lib, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2010-2642, CVE-20 ...

CWE-20 http://www.kb.cert.org/vuls/id/376500 http://www.foolabs.com/xpdf/download.html http://secunia.com/advisories/43823 http://www.vupen.com/english/advisories/2011/0728 http://www.toucan-system.com/advisories/tssa-2011-01.txt http://www.securityfocus.com/bid/46941 http://www.kb.cert.org/vuls/id/MAPG-8ECL8X http://securitytracker.com/id?1025266 http://securityreason.com/securityalert/8171 http://www.mandriva.com/security/advisories?name=MDVSA-2012:002 http://www.ubuntu.com/usn/USN-1316-1 http://secunia.com/advisories/47347 http://rhn.redhat.com/errata/RHSA-2012-1201.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:144 http://secunia.com/advisories/48985 https://security.gentoo.org/glsa/201701-57 https://exchange.xforce.ibmcloud.com/vulnerabilities/66208 http://www.securityfocus.com/archive/1/517205/100/0/threaded https://usn.ubuntu.com/1316-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/376500

CVE-2011-0764

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect