• Published Date: Sat 21 Nov 2020
  • Last Modified Date: Thu 03 Dec 2020

In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.

References (Advisories, Solutions, and Tools):

Note: This page is generated by our securitybot and has not been checked for errors. Feed Source: NVD