CVE-2019-9587

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-95887.8There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file CVE-2019-95897.8There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01. It can be trigger CVE-2019-95907.5An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service (persistent failure m CVE-2019-95916.1A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitr CVE-2019-95926.1A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web CVE-2019-95936.1A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web CVE-2019-95949.8BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request.CVE-2019-95956.1AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.CVE-2019-95966.5Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint.CVE-2019-95976.5Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint.CVE-2019-95986.5An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.CVE-2019-95997.5The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultane