CVE-2016-5184
HighSummary
PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; and 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot. This allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.
Risk Assessment
The organization may be exposed to remote attacks that could lead to data corruption or system takeover through malicious PDF files.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in PDFium w Google Chrome
See all- CVE-2017-5114High
Inappropriate use of partition alloc in PDFium in Google Chrome prior to version 61.0.3163.79 for Linux, Windows, and Mac, and prior to version 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.
- CVE-2017-5057High
Type confusion in PDFium in Google Chrome prior to version 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- CVE-2017-5039High
A use after free in PDFium in Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux and prior to version 57.0.2987.108 for Android allows a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2017-5036High
A use after free in PDFium in Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux and prior to version 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.
- CVE-2017-5034High
A use after free in PDFium in Google Chrome prior to version 57.0.2987.98 for Linux and Windows allows a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- CVE-2017-5032High
PDFium in Google Chrome prior to version 57.0.2987.98 for Windows could be made to increment off the end of a buffer, allowing a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2016-5210High
Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2016-5203High
A use after free in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- CVE-2016-1619High
Multiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb functions in PDFium, used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
- CVE-2015-6778High
The CJBig2_SymbolDict class in PDFium, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
Original NVD description (English source)
PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.