Description
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.
Recommendation
Update the pdfjs-dist package to the latest compatible version. Followings are version details:
Affected version(s): **< 1.10.100 >= 2.0.0, < 2.0.550** Patched version(s): **1.10.100 2.0.550**
References
- GHSA-7jg2-jgv3-fmr4
- access.redhat.com
- bugzilla.mozilla.org
- lists.debian.org
- security.gentoo.org
- www.debian.org
- www.securityfocus.com
- www.securitytracker.com
- usn.ubuntu.com
- www.mozilla.org
- CVE-2018-5158
- CWE-94
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
- Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
- PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
- QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954
- Tags:
- npm
- pdfjs-dist
Anything's wrong? Let us know Last updated on May 28, 2024