3 ms·
Having the POC pdf files would be interesting (together with a plain invalidly signed pdf). I don't even know if these pdf readers check signatures: okular, evi
by leni536 8y ago
Having the POC pdf files would be interesting (together with a plain invalidly signed pdf). I don't even know if these pdf readers check signatures: okular, evince, mupdf, qpdfview, sumatra.
- hannob 8y agoPOC files: https://www.pdf-insecurity.org/signature/viewer.html https://www.pdf-insecurity.org/signature/viewer.html And most of the readers you mention don't support signature verification - so they're perfectly secure from this attack ;-)
- leni536 8y agopdfsig from poppler-utils is vulnerable to SWA. I expect any poppler based pdf readers (that actually bothers with signatures) to have the same vulnerability. edit: mutool sign is also vulnerable to SWA.