CVE: CVE-2010-3704

Export to Word

The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.

Threat-Mapped Scoring

Score: 1.9

Priority: P3 - Important (Medium)

S9 – Sabotage of System/App
S10 – Denial of Service (+0.1 bonus)

EPSS

Score: 0.01533
Percentile: 0.8051

CVSS Scoring

CVSS v2 Score: 6.8

Severity:

Mapped CWE(s)

CWE-20 : Improper Input Validation

All CAPEC(s)

CAPEC-10: Buffer Overflow via Environment Variables
CAPEC-101: Server Side Include (SSI) Injection
CAPEC-104: Cross Zone Scripting
CAPEC-108: Command Line Execution through SQL Injection
CAPEC-109: Object Relational Mapping Injection
CAPEC-110: SQL Injection through SOAP Parameter Tampering
CAPEC-120: Double Encoding
CAPEC-13: Subverting Environment Variable Values
CAPEC-135: Format String Injection
CAPEC-136: LDAP Injection
CAPEC-14: Client-side Injection-induced Buffer Overflow
CAPEC-153: Input Data Manipulation
CAPEC-182: Flash Injection
CAPEC-209: XSS Using MIME Type Mismatch
CAPEC-22: Exploiting Trust in Client
CAPEC-23: File Content Injection
CAPEC-230: Serialized Data with Nested Payloads
CAPEC-231: Oversized Serialized Data Payloads
CAPEC-24: Filter Failure through Buffer Overflow
CAPEC-250: XML Injection
CAPEC-261: Fuzzing for garnering other adjacent user/sensitive data
CAPEC-267: Leverage Alternate Encoding
CAPEC-28: Fuzzing
CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
CAPEC-42: MIME Conversion
CAPEC-43: Exploiting Multiple Input Interpretation Layers
CAPEC-45: Buffer Overflow via Symbolic Links
CAPEC-46: Overflow Variables and Tags
CAPEC-47: Buffer Overflow via Parameter Expansion
CAPEC-473: Signature Spoof
CAPEC-52: Embedding NULL Bytes
CAPEC-53: Postfix, Null Terminate, and Backslash
CAPEC-588: DOM-Based XSS
CAPEC-63: Cross-Site Scripting (XSS)
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-664: Server Side Request Forgery
CAPEC-67: String Format Overflow in syslog()
CAPEC-7: Blind SQL Injection
CAPEC-71: Using Unicode Encoding to Bypass Validation Logic
CAPEC-72: URL Encoding
CAPEC-73: User-Controlled Filename
CAPEC-78: Using Escaped Slashes in Alternate Encoding
CAPEC-79: Using Slashes in Alternate Encoding
CAPEC-8: Buffer Overflow in an API Call
CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic
CAPEC-81: Web Server Logs Tampering
CAPEC-83: XPath Injection
CAPEC-85: AJAX Footprinting
CAPEC-88: OS Command Injection
CAPEC-9: Buffer Overflow in Local Command-Line Utilities

CAPEC(s) with Mapped TTPs

CAPEC-13: Subverting Environment Variable Values
Mapped TTPs:
- T1562.003 : Impair Command History Logging
- T1574.006 : Dynamic Linker Hijacking
- T1574.007 : Path Interception by PATH Environment Variable
CAPEC-267: Leverage Alternate Encoding
Mapped TTPs:
- T1027 : Obfuscated Files or Information
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
Mapped TTPs:
- T1539 : Steal Web Session Cookie
CAPEC-473: Signature Spoof
Mapped TTPs:
- T1036.001 : Invalid Code Signature
- T1553.002 : Code Signing

Mapped ATT&CK TTPs

T1562.003 : Impair Command History Logging
Kill Chain: defense-evasion
T1574.006 : Dynamic Linker Hijacking
Kill Chain: persistence
T1574.007 : Path Interception by PATH Environment Variable
Kill Chain: persistence
T1027 : Obfuscated Files or Information
Kill Chain: defense-evasion
T1539 : Steal Web Session Cookie
Kill Chain: credential-access
T1036.001 : Invalid Code Signature
Kill Chain: defense-evasion
T1553.002 : Code Signing
Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

APT41 DUST
ArcaneDoor
SolarWinds Compromise
Operation Honeybee
2016 Ukraine Electric Power Attack
RedDelta Modified PlugX Infection Chain Operations
Operation Dream Job
C0015
C0017

Affected Products

cpe:2.3:a:poppler:poppler:0.8.7:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.9.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.2:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.3:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.4:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.5:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.6:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.10.7:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.11.1:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.11.2:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.11.3:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.12.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.12.2:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.12.3:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.12.4:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.13.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.13.2:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.13.3:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.13.4:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.14.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.14.1:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.14.2:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.14.3:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.14.4:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.14.5:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.15.0:*:*:*:*:*:*:*
cpe:2.3:a:poppler:poppler:0.15.1:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.5a:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.7a:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.91a:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.91b:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.91c:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.92a:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.92b:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.92c:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.92d:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.92e:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.93a:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.93b:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:0.93c:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:1.00a:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:3.02pl1:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:3.02pl2:*:*:*:*:*:*:*
cpe:2.3:a:foolabs:xpdf:3.02pl3:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:*:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.2:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.3:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.4:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.5:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.6:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.7:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.80:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.90:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.91:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.92:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:0.93:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:1.00:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:1.01:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:2.00:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:2.01:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:2.02:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:2.03:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:3.00:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:3.01:*:*:*:*:*:*:*
cpe:2.3:a:glyphandcog:xpdfreader:3.02:*:*:*:*:*:*:*
cpe:2.3:a:kde:kdegraphics:*:*:*:*:*:*:*:*

← Back to Home