CVE-2020-25725

In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed t3GlyphStack->cache, which causes an heap-use-after-free problem. The codes of a previous fix for nested Type 3 characters wasnt correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name	Vendor	Start Version	End Version
Xpdf	Xpdfreader	4.02 (including)	4.02 (including)
Ipe	Ubuntu	bionic	*
Ipe	Ubuntu	focal	*
Ipe	Ubuntu	groovy	*
Ipe	Ubuntu	hirsute	*
Ipe	Ubuntu	impish	*
Ipe	Ubuntu	kinetic	*
Ipe	Ubuntu	lunar	*
Ipe	Ubuntu	mantic	*
Ipe	Ubuntu	oracular	*
Ipe	Ubuntu	plucky	*
Ipe	Ubuntu	trusty	*
Ipe	Ubuntu	xenial	*
Poppler	Ubuntu	trusty	*
Xpdf	Ubuntu	hirsute	*
Xpdf	Ubuntu	impish	*
Xpdf	Ubuntu	trusty	*
Xpdf	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-25725
CWE	https://cwe.mitre.org/data/definitions/416.html

Use After Free

Weakness

Affected Software

Potential Mitigations

References