libextractor vulnerabilities and fixes

Recent CVEs affecting libextractor, with upgrade or downgrade steps. 18 tracked.

libextractor has 18 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2019-08-23. Highest priority: CVE-2005-3625 (score 63/100).

• CVE-2019-15531 MEDIUM 6.5 UPGRADE MITIGATE GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in
• CVE-2018-20431 MEDIUM 6.5 UPGRADE MITIGATE GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() i
• CVE-2018-20430 MEDIUM 6.5 UPGRADE MITIGATE GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plug
• CVE-2018-16430 HIGH 8.8 UPGRADE MITIGATE GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_
• CVE-2018-14347 MEDIUM 6.5 MITIGATE UPGRADE GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_ext
• CVE-2018-14346 HIGH 8.8 MITIGATE UPGRADE GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).
• CVE-2017-17440 MEDIUM 6.5 DOWNGRADE GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
• CVE-2017-15922 MEDIUM 5.5 DOWNGRADE In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugin
• CVE-2017-15602 HIGH 7.5 DOWNGRADE In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract
• CVE-2017-15601 HIGH 7.5 DOWNGRADE In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in
• CVE-2017-15600 HIGH 7.5 DOWNGRADE In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of p
• CVE-2017-15267 HIGH 7.5 DOWNGRADE In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c.
• CVE-2017-15266 MEDIUM 5.5 DOWNGRADE In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a ze
• CVE-2006-2458 MEDIUM 4.0 DOWNGRADE Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbi
• CVE-2006-1244 HIGH 7.6 DOWNGRADE DOWNGRADE Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pd
• CVE-2005-3626 MEDIUM 5.0 DOWNGRADE DOWNGRADE Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allow
• CVE-2005-3625 HIGH 10.0 DOWNGRADE DOWNGRADE Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allow
• CVE-2005-3624 MEDIUM 5.0 DOWNGRADE DOWNGRADE The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS

FAQ

How do I fix libextractor vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is libextractor being exploited right now?

None of the tracked libextractor CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which libextractor CVE should I patch first?

CVE-2005-3625 currently ranks highest (63/100): Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allow.

RSS feed for libextractor · ← Back to latest CVEs