Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-13257 State: PUBLISHED Published: 2019-07-04T15:06:35 Last Updated: 2024-08-04T23:49:23.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003273aa. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x00000000003273aa.md
CVE ID: CVE-2019-13258 State: PUBLISHED Published: 2019-07-04T15:06:44 Last Updated: 2024-08-04T23:49:23.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328165. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x0000000000328165.md
CVE ID: CVE-2019-13259 State: PUBLISHED Published: 2019-07-04T15:06:51 Last Updated: 2024-08-04T23:49:24.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e566. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x000000000032e566.md
CVE ID: CVE-2019-13260 State: PUBLISHED Published: 2019-07-04T15:06:59 Last Updated: 2024-08-04T23:49:24.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327a07. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x0000000000327a07.md
CVE ID: CVE-2019-13261 State: PUBLISHED Published: 2019-07-04T15:07:05 Last Updated: 2024-08-04T23:49:24.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328384. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x0000000000328384.md
CVE ID: CVE-2019-13262 State: PUBLISHED Published: 2019-07-04T15:07:13 Last Updated: 2024-08-04T23:49:23.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003283eb. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x00000000003283eb.md
CVE ID: CVE-2019-13263 State: PUBLISHED Published: 2019-08-27T17:07:31 Last Updated: 2024-08-04T23:49:24.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-
the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field. Additional Analyst Notes: - CVE Program Container: References: - https://orenlab.sise.bgu.ac.il/publications/CrossRouter - https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
CVE ID: CVE-2019-13264 State: PUBLISHED Published: 2019-08-27T17:07:00 Last Updated: 2024-08-04T23:49:23.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sen
ost and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender. Additional Analyst Notes: - CVE Program Container: References: - https://orenlab.sise.bgu.ac.il/publications/CrossRouter - https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
CVE ID: CVE-2019-13265 State: PUBLISHED Published: 2019-08-27T17:06:36 Last Updated: 2024-08-04T23:49:24.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restric
uters restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.) Additional Analyst Notes: - CVE Program Container: References: - https://orenlab.sise.bgu.ac.il/publications/CrossRouter - https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
CVE ID: CVE-2019-13266 State: PUBLISHED Published: 2019-08-27T17:06:10 Last Updated: 2024-08-04T23:49:23.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cros
d Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field. Additional Analyst Notes: - CVE Program Container: References: - https://orenlab.sise.bgu.ac.il/publications/CrossRouter - https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
CVE ID: CVE-2019-13267 State: PUBLISHED Published: 2019-08-27T17:05:39 Last Updated: 2024-08-04T23:49:24.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely
ends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender. Additional Analyst Notes: - CVE Program Container: References: - https://orenlab.sise.bgu.ac.il/publications/CrossRouter - https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
CVE ID: CVE-2019-13268 State: PUBLISHED Published: 2019-08-27T17:05:06 Last Updated: 2024-08-04T23:49:24.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these ro
(In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.) Additional Analyst Notes: - CVE Program Container: References: - https://orenlab.sise.bgu.ac.il/publications/CrossRouter - https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
CVE ID: CVE-2019-13269 State: PUBLISHED Published: 2019-08-27T17:04:20 Last Updated: 2024-08-04T23:49:24.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-
CVE ID: CVE-2019-13270 State: PUBLISHED Published: 2019-08-27T17:03:43 Last Updated: 2024-08-04T23:49:24.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sen
CVE ID: CVE-2019-13271 State: PUBLISHED Published: 2019-08-27T16:57:30 Last Updated: 2024-08-04T23:49:24.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restric
CVE ID: CVE-2019-13272 State: PUBLISHED Published: 2019-07-17T12:32:55.000Z Last Updated: 2025-10-21T23:45:33.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptra
r is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html - https://bugs.chromium.org/p/project-zero/issues/detail?id=1903 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17 - https://github.com/torvalds/linux/commit/6994eefb00
03 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17 - https://github.com/torvalds/linux/commit/6994eefb0053799d2e07cd140df6c2ea106c41ee - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994eefb0053799d2e07cd140df6c2ea106c41ee - https://bugzilla.suse.com/show_bug.cgi?id=1140671 - https://bugzilla.redhat.com/show_bug.cgi?id=1730895 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGRK5LYWBJ4E4SRI4DKX367NHYSI3VOH/ - https://www.debian.org/security/2019/dsa-4484 - https://seclists.org/bugtraq/2019/Jul/30 - https://seclists.org/bugtraq/2019/Jul/33 - https://lists.debian.org/debian-lts-announce/2019/07/msg
ugtraq/2019/Jul/30 - https://seclists.org/bugtraq/2019/Jul/33 - https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html - https://lists.debian.org/debian-lts-announce/2019/07/msg00023.html - http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://security.netapp.com/advisory/ntap-20190806-0001/ - https://access.redhat.com/errata/RHSA-2019:2405 - https://access.redhat.com/errata/RHSA-2019:2411 - https://usn.ubuntu.com/4093-1/ - https://usn.ubuntu.com/4094-1/ - https://usn.ubuntu.com/4095-1/ - http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html - https://support.f5.com/csp/article/
etstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html - https://support.f5.com/csp/article/K91025336 - https://usn.ubuntu.com/4117-1/ - https://usn.ubuntu.com/4118-1/ - https://access.redhat.com/errata/RHSA-2019:2809 - https://support.f5.com/csp/article/K91025336?utm_source=f5support&amp%3Butm_medium=RSS - http://packetstormsecurity.com/files/154957/Linux-Polkit-pkexec-Helper-PTRACE_TRACEME-Local-Root.html - http://packetstormsecurity.com/files/156929/Linux-PTRACE_TRACEME-Local-Root.html - http://packetstormsecurity.com/files/165051/Linux-Kernel-5.1.x-PTRACE_TRACEME-pkexec-Local-Privilege-Escalation.html
CVE ID: CVE-2019-13273 State: PUBLISHED Published: 2019-08-27T16:52:01 Last Updated: 2024-08-04T23:49:24.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that triggers an sprintf of the srcdb parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c - https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html
CVE ID: CVE-2019-13274 State: PUBLISHED Published: 2019-08-27T16:49:13 Last Updated: 2024-08-04T23:49:23.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c - https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html
CVE ID: CVE-2019-13275 State: PUBLISHED Published: 2019-07-04T18:51:22 Last Updated: 2024-08-04T23:49:23.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-statistics/#developers - https://github.com/wp-statistics/wp-statistics/commit/bd46721b97794a1b1520e24ff5023b6da738dd75 - https://wpvulndb.com/vulnerabilities/9412
CVE ID: CVE-2019-13276 State: PUBLISHED Published: 2019-07-10T16:19:06 Last Updated: 2024-08-04T23:49:24.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated user to execute arbitrary code by providing a sufficiently long query string when POSTing to any valid cgi, txt, asp, or js file. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-132
st Notes: - CVE Program Container: References: - https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13276
CVE ID: CVE-2019-13277 State: PUBLISHED Published: 2019-07-09T20:28:49 Last Updated: 2024-08-04T23:49:23.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality, giving this attacker the ability to change configuration values, potentially leading to a denial of service. The request can be made on the local intranet or remotely if remote administration is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13277
CVE ID: CVE-2019-13278 State: PUBLISHED Published: 2019-07-10T16:23:37 Last Updated: 2024-08-04T23:49:24.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13278
CVE ID: CVE-2019-13279 State: PUBLISHED Published: 2019-07-10T16:27:52 Last Updated: 2024-08-04T23:49:23.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for the setup wizard, allowing an unauthenticated user to execute arbitrary code. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13279
CVE ID: CVE-2019-13280 State: PUBLISHED Published: 2019-07-09T18:44:23 Last Updated: 2024-08-04T23:49:24.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can be exercised on the local intranet or remotely if remote administration is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13280
CVE ID: CVE-2019-13281 State: PUBLISHED Published: 2019-07-04T19:47:55 Last Updated: 2024-08-04T23:49:23.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service, an information leak, or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41841 - https://lists.fedoraproject.org/archives/lis
ner: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41841 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
CVE ID: CVE-2019-13282 State: PUBLISHED Published: 2019-07-04T19:48:09 Last Updated: 2024-08-04T23:49:24.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41842 - https://lists.fedoraproject
VE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41842 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
CVE ID: CVE-2019-13283 State: PUBLISHED Published: 2019-07-04T19:48:23 Last Updated: 2024-08-04T23:49:24.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://forum.
possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41843 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
CVE ID: CVE-2019-13285 State: PUBLISHED Published: 2020-05-04T13:36:13 Last Updated: 2024-08-04T23:49:24.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.endpointprotector.com/products/endpoint-protector - https://www.esecforte.com/endpoint-protector-india-cososys-dlp/
CVE ID: CVE-2019-13286 State: PUBLISHED Published: 2019-07-04T21:06:41 Last Updated: 2024-08-04T23:49:24.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PanguL4b/pocs/tree/master/xpdf/heap-buffer-overflow_JBIG2Stream__readTextRegionSeg - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro