PDFium vulnerabilities

Heap buffer overflow in PDFium in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

Heap buffer overflow in PDFium in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

A use after free in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and prior to version 55.0.2883.84 for Android allows a remote attacker to potentially exploit heap corruption via a crafted PDF file.

Multiple heap-based buffer overflows in PDFium, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.

PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux mishandles timers, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document.

In PDFium, used in Google Chrome before version 50.0.2661.75, the sycc420_to_rgb and sycc422_to_rgb functions are not properly implemented, allowing remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document.

Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before version 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.

In PDFium, used in Google Chrome before version 47.0.2526.73, the fxjs_v8.cpp file does not use signatures, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage 'type confusion.'

Integer overflow in the CJBig2_Image::expand function in PDFium, used in Google Chrome before version 44.0.2403.89, may lead to denial of service (heap-based buffer overflow) or other unspecified impacts due to large height and stride values.

PDFium, as used in Google Chrome before version 43.0.2357.65, does not properly initialize memory, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Use-after-free vulnerability in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.

A use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in PDFium, used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.

The chrome_pdf::CopyImage function in the PDFium component in Google Chrome before version 38.0.2125.101 does not properly validate image-data dimensions, which may lead to denial of service (out-of-bounds read) or other unspecified impacts.

An inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. The issue is rated as medium severity.

A use-after-free vulnerability was found in PDFium in Google Chrome prior to version 150.0.7871.47. A remote attacker could exploit a crafted PDF file to execute arbitrary code inside a sandbox.

An integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted font file.

A use-after-free vulnerability in PDFium in Google Chrome prior to 148.0.7778.216 allows a remote attacker to potentially exploit heap corruption via a crafted PDF file.

A use-after-free vulnerability in PDFium in Google Chrome prior to 148.0.7778.216 allows a remote attacker to potentially exploit heap corruption via a crafted PDF file.

A cryptographic flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack.