Description
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GNOME libgxps
Default version status: unaffected
0 to ≤ 0.3.2affected
References
- https://hackmd.io/@haind-pwn/libgxps-poly-segment-points-arity-oob-read ↗
- https://gitlab.gnome.org/GNOME/libgxps/-/blob/f5027ed09c767e8a02e652fbc77dcea79e19e10d/libgxps/gxps-path.c#L776-L785 ↗
- https://gitlab.gnome.org/GNOME/libgxps/-/blob/f5027ed09c767e8a02e652fbc77dcea79e19e10d/libgxps/gxps-path.c#L832-L848 ↗
- https://gitlab.gnome.org/GNOME/libgxps ↗
- https://www.vulncheck.com/advisories/gnome-libgxps-through-0.3.2-heap-out-of-bounds-read-via-path-geometry-start-element ↗