PDF-XChange Viewer - Shading Type 7 Heap Memory Corruption

vendor:

PDF-XChange Viewer

by:

Sébastien Morin

7,5

CVSS

HIGH

Heap Memory Corruption

119

CWE

Product Name: PDF-XChange Viewer

Affected Version From: 2.5.315.0

Affected Version To: 2.5.315.0

Patch Exists: YES

Related CWE: N/A

CPE: a:tracker-software:pdf-xchange_viewer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2015

PDF-XChange Viewer – Shading Type 7 Heap Memory Corruption

A heap memory corruption occurs when PDF-XChange Viewer handle a invalid Shading Type 7 stream. An attacker can leverage this vulnerability to potentially execute arbitrary code on vulnerable installations of PDF-XChange Viewer.

Mitigation:

Upgrade to the latest version of PDF-XChange Viewer (version 2.5.316.1)

Source

Exploit-DB raw data:

########################################################################################

# Title: PDF-XChange Viewer - Shading Type 7 Heap Memory Corruption 
# Application: PDF-XChange Viewer
# Version 2.5.315.0
# Platform: Windows
# Software Link: http://www.tracker-software.com/
# Date: 2015-11-15
# Author: Sébastien Morin from COSIG
# Contact: https://twitter.com/COSIG_ (@COSIG_)
# Personal contact: https://twitter.com/SebMorin1 (@SebMorin1)

########################################################################################

===================
Introduction:
===================

PDF-XChange Viewer is a proprietary PDF reader for Microsoft Windows available for free. The basic reader, which can be downloaded free of charge, includes extended/markup capabilities such as typing, highlighting, callouts, and notes. Another useful feature is its ability to display PDF files in the "preview" pane of the Windows Explorer without locking the file (and thus allowing for easy setting of metadata info). An advanced paid version is also available.
(https://en.wikipedia.org/wiki/PDF-XChange_Viewer)

########################################################################################

===================
Report Timeline:
===================

2015-11-15 Sébastien Morin from COSIG found the vulnerability;
2015-11-16 Sébastien Morin from COSIG report the vulnerability to vendor;
2015-11-16 Vendor fixed the issue;
2016-01-18 Vendor released fixed version of PDF-XChange Viewer (version 2.5.316.1)
2016-01-18 Advisory Release


########################################################################################

===================
Technical details:
===================

A heap memory corruption occurs when PDF-XChange Viewer handle a invalid Shading Type 7 stream.

An attacker can leverage this vulnerability to potentially execute arbitrary code on vulnerable installations of PDF-XChange Viewer.

########################################################################################

==========
POC:
==========

https://smsecurity.net/pdf-xchange-viewer-shading-type-7-heap-memory-corruption/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39275.zip

########################################################################################