1130965 – (CVE-2019-10025) VUL-1: CVE-2019-10025: xpdf: floating point exception in function ImageStream:ImageStream in Stream.cc

Bug 1130965 (CVE-2019-10025) - VUL-1: CVE-2019-10025: xpdf: floating point exception in function ImageStream:ImageStream in Stream.cc

Summary: VUL-1: CVE-2019-10025: xpdf: floating point exception in function ImageStream...

Status:	RESOLVED INVALID

Alias:	CVE-2019-10025

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assignee:	Peter Simons
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/226993/
Whiteboard:	CVSSv3:SUSE:CVE-2019-10025:3.3:(AV:L/...
Keywords:

Depends on:
Blocks:	1133493
	Show dependency tree / graph

Clone This Bug

Reported:	2019-03-29 10:35 UTC by Robert Frohl
Modified:	2023-06-14 14:52 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
QA Reproducer (3.50 KB, application/gzip) 2019-03-29 11:01 UTC, Robert Frohl	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2019-03-29 10:35:18 UTC

rh#1693642

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits.

Reference:
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1693642
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10025
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10025.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10025
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274

Comment 1 Robert Frohl 2019-03-29 11:01:24 UTC

Created attachment 801657 [details]
QA Reproducer

$ pdftoppm ImageStream::ImageStream@Stream.cc:359-23___FPE out.ppm
Error: PDF file is damaged - attempting to reconstruct xref table...
Error (357): Dictionary key must be a name object
Error (359): Dictionary key must be a name object
Error (377): Dictionary key must be a name object
Floating point exception