CVE:CVE-2010-3704
CNNVD:CNNVD-201011-036
xpdf 3.02pl5之前版本，poppler 0.8.7及0.15.1之前的其他版本，kdegraphics及其他产品中的PDF解析器中的fofi/FoFiType1.cc文件中的FoFiType1::parse函数存在输入验证漏洞。上下文攻击者可以借助包含负数组索引的特制Type1字体的PDF文件导致拒绝服务(崩溃)并有可能执行任意代码。该漏洞可以绕过输入校验并触发内存破坏。
solution:Upgrade poppler poppler to a higher version than 0.8.7,0.9.0,0.9.1,0.9.2,0.9.3,0.10.0,0.10.1,0.10.2,0.10.3,0.10.4,0.10.5,0.10.6,0.10.7,0.11.0,0.11.1,0.11.2,0.11.3,0.12.0,0.12.1,0.12.2,0.12.3,0.12.4,0.13.0,0.13.1,0.13.2,0.13.3,0.13.4,0.14.0,0.14.1,0.14.2,0.14.3,0.14.4,0.14.5,0.15.0,0.15.1,and avoid the version 0.8.7,0.9.0,0.9.1,0.9.2,0.9.3,0.10.0,0.10.1,0.10.2,0.10.3,0.10.4,0.10.5,0.10.6,0.10.7,0.11.0,0.11.1,0.11.2,0.11.3,0.12.0,0.12.1,0.12.2,0.12.3,0.12.4,0.13.0,0.13.1,0.13.2,0.13.3,0.13.4,0.14.0,0.14.1,0.14.2,0.14.3,0.14.4,0.14.5,0.15.0,0.15.1; Upgrade foolabs xpdf to a higher version than 0.5a,0.7a,0.91a,0.91b,0.91c,0.92a,0.92b,0.92c,0.92d,0.92e,0.93a,0.93b,0.93c,1.00a,3.0.1,3.02pl1,3.02pl2,3.02pl3,and avoid the version 0.5a,0.7a,0.91a,0.91b,0.91c,0.92a,0.92b,0.92c,0.92d,0.92e,0.93a,0.93b,0.93c,1.00a,3.0.1,3.02pl1,3.02pl2,3.02pl3; Upgrade glyphandcog xpdfreader to a higher version than 3.02,0.2,0.3,0.4,0.5,0.6,0.7,0.80,0.90,0.91,0.92,0.93,1.00,1.01,2.00,2.01,2.02,2.03,3.00,3.01,3.02,and avoid the version (,3.02],0.2,0.3,0.4,0.5,0.6,0.7,0.80,0.90,0.91,0.92,0.93,1.00,1.01,2.00,2.01,2.02,2.03,3.00,3.01,3.02; Upgrade kde kdegraphics to a higher version than *