[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n
<\/span><\/p>\n <\/span>Advisory ID<\/strong>: usd-2018-0019<\/span> Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document.<\/p>\n There are many ways an attacker could exploit this issue, the most straight forward would be to overflow critical data like function pointers that happen to be allocated next to the heap-chunk that overflows. Calling a function by a function pointer that is controlled by an attacker will give the attacker full control over the running process and the attacker would then be able to run arbitrary code which is considered a very critical vulnerability.<\/p>\n <\/span><\/p>\n Not available.<\/span><\/p>\n <\/p>\n Issue is fixed in Build 2.5.322.8 on 24. January 2018 by Tracker Software<\/p>\n <\/p>\n <\/p>\n This security vulnerabilities were found by Sebastian Feldmann of usd AG.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2018-0019 | Pdf-Xchange Viewer, Viewer AX SDK\/2.5.322.7 and earlier Advisory ID: usd-2018-0019CVE Number: CVE-2018-6462Affected Product: Pdf-Xchange ViewerAffected Version: 2.5.322.7 and earlierVulnerability Type: Heap OverflowSecurity Risk: HighVendor URL: https:\/\/www.tracker-software.comVendor Status: Fixed Description Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16561","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16561"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16561\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
CVE Number<\/strong>: CVE-2018-6462<\/span>
Affected Product<\/strong>: Pdf-Xchange Viewer<\/span>
Affected Version<\/strong>: 2.5.322.7 and earlier<\/span>
Vulnerability Type<\/strong>: Heap Overflow<\/span>
Security Risk<\/strong>: High<\/span>
Vendor URL<\/strong>: <\/span>https:\/\/www.tracker-software.com<\/a>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n<\/h3>\n
Description<\/h3>\n
Proof of Concept (PoC)<\/h3>\n
Fix<\/h3>\n
Timeline<\/h3>\n
\n
Credits<\/h3>\n