Kofax Power PDF JP2 Parsing Out-Of-Bounds Read Info Disclosure (CVE-2024-5512)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability 2. Vulnerability ID: ZDI-24-555, ZDI-CAN-22021 3. CVE ID: CVE-2024-5512 4. CVSS Score: 3.3, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N 5. Affected Vendor: Kofax 6. Affected Product: Power PDF 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to disclose sensitive information on affected installations of Kofax Power PDF. - User interaction is required, as the target must access a malicious page or open a malicious file. - The issue lies in the parsing of JP2 files. Due to insufficient validation of user-supplied data, the vulnerability allows out-of-bounds reads beyond the allocated object boundaries. Attackers could exploit this, in combination with other vulnerabilities, to execute arbitrary code within the context of the current process. 8. Additional Details: - Detailed Information Link 9. Disclosure Timeline: - 2023-08-24 - Vulnerability reported to vendor - 2024-05-31 - Coordinated public disclosure of vulnerability advisory - 2024-07-01 - Vulnerability advisory updated 10. Credit: - Mat Powell of Trend Micro Zero Day Initiative This information provides a detailed description of the vulnerability, including its severity, affected systems and vendors, and specifics on how the vulnerability can be exploited.

Goal Reached Thanks to every supporter — we hit 100%!

Kofax Power PDF JP2 Parsing Out-Of-Bounds Read Info Disclosure (CVE-2024-5512)