CVE-2010-3704: Input Validation
An array indexing error was found in the way xpdf / poppler parsed Type1 fonts embedded in PDF documents. In FoFiType1::parse(), text representation of the numeric code value was converted to integer value using atoi(). This value was checked to ensure it's less than 256, but there was no check to ensure it's not negative (string passed to atoi() was checked to only contain characters '0'-'9' before the call though). On platforms, where atoi() could return negative result when parsing large positive values (exceeding INTMAX), this could could lead to write out of array bounds due to use of negative index.
poppler upstream commit: http://cgit.freedesktop.org/poppler/poppler/commit/?id=39d140bfc0b8239bdd96d6a55842034ae5c05473
Reference: http://secunia.com/advisories/41596/
Other sources
The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3704?
CVE-2010-3704 has been assigned a CVSS severity score of 4.3, indicating a medium-level vulnerability.
What types of attacks can exploit CVE-2010-3704?
CVE-2010-3704 can be exploited through crafted PDF documents that contain Type1 fonts, potentially leading to denial of service.
How do I fix CVE-2010-3704?
To fix CVE-2010-3704, update to the latest version of Poppler or Xpdf that addresses this vulnerability.
Which versions are affected by CVE-2010-3704?
CVE-2010-3704 affects Poppler versions from 0.8.7 to 0.14.5 and Xpdf versions from 0.5a to 3.02.
Is CVE-2010-3704 still a risk today?
CVE-2010-3704 may still pose a risk if vulnerable software versions are in use, making updates essential for security.