Log in Start free

Vulnerability · Published Nov 21, 2020 · Assigned by redhat

CVE-2020-25725

Medium 5.0

In plain English

A medium-severity use-after-free in xpdf from Glyph & Cog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)1.0%top 36.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xpdf4.03-r0ALPINE-CVE-2020-25725
Alpine:v3.21xpdf4.03-r0ALPINE-CVE-2020-25725
Alpine:v3.22xpdf4.03-r0ALPINE-CVE-2020-25725
Alpine:v3.23xpdf4.03-r0ALPINE-CVE-2020-25725
Alpine:v3.24xpdf4.03-r0ALPINE-CVE-2020-25725
Ubuntu:22.04:LTSipeno fix listedUBUNTU-CVE-2020-25725
Ubuntu:24.04:LTSipeno fix listedUBUNTU-CVE-2020-25725
Ubuntu:25.10ipeno fix listedUBUNTU-CVE-2020-25725
Ubuntu:26.04:LTSipeno fix listedUBUNTU-CVE-2020-25725
Ubuntu:26.10ipeno fix listedUBUNTU-CVE-2020-25725

Affected products (as reported)

VendorProductVersions
Glyph & Cog xpdf 4.02

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References