CVE-2019-13288 PoC — Xpdf 资源管理错误漏洞

Source

https://github.com/Fineas/CVE-2019-13288-POC

Associated Vulnerability

Title:Xpdf 资源管理错误漏洞 (CVE-2019-13288)
Description:Xpdf是Foo实验室的一款开源的PDF阅读器。该产品支持解码LZW压缩格式的文件以及阅读加密的PDF文件。 Xpdf 4.01.01版本中的Parser.cc文件的‘Parser::getObj()’函数存在安全漏洞。攻击者可借助特制的文件利用该漏洞造成拒绝服务（无限递归）。

Readme

# CVE-2019-13288-POC

`xpdf/install/bin/pdftotext ./poc.pdf `

> In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.

![POC backtrace](backtrace.jpeg)

File Snapshot


 [4.0K]  /data/pocs/dd7e6cada976d23433d453000258e238526b5c2d
├── [663K]  backtrace.jpeg
├── [7.0K]  poc.pdf
└── [ 297]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!