CVEvulnerability

CVE-2019-5019

9.8 CRITICAL Published 2019-03-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-122, CWE-787

Description

A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018,1113). While parsing Document Summary Property Set stream, the getSummaryInformation function is incorrectly checking the correlation between size and the number of properties in PropertySet packets, causing an out-of-bounds write that leads to heap corruption and consequent code execution.

Affected configurations

• rainbowpdf office server document converter 7.0

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References