Vulnerabilities > CVE-2019-5019 - Out-of-bounds Write vulnerability in Rainbowpdf Office Server Document Converter 7.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018,1113). While parsing Document Summary Property Set stream, the getSummaryInformation function is incorrectly checking the correlation between size and the number of properties in PropertySet packets, causing an out-of-bounds write that leads to heap corruption and consequent code execution.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Talos
| id | TALOS-2019-0780 |
| last seen | 2019-05-29 |
| published | 2019-02-28 |
| reporter | Talos Intelligence |
| source | http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0780 |
| title | Antenna House Rainbow PDF Office server document converter getSummaryInformation NumProperties code execution vulnerability |