CVE-2024-1358: 
WordPress vulnerability analysis and mitigation

A vulnerability has been identified in Tungsten Automation Power PDF related to the parsing of OXPS files. The vulnerability, tracked as CVE-2024-1358 (ZDI-24-1358), was discovered and reported on June 13, 2024, with public disclosure occurring on October 11, 2024 (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data during OXPS file parsing, which can result in an out-of-bounds read past the end of an allocated object. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a relatively low severity but still significant security concern (ZDI Advisory).

When exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. The vulnerability could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The vulnerability was discovered by Mat Powell of Trend Micro Zero Day Initiative (ZDI Advisory).

The vulnerability has been fixed in version 5.1 of Tungsten Automation Power PDF, which is available through the Tungsten Download Center. Users are advised to update to this version to mitigate the vulnerability (ZDI Advisory).