hi, pdflib, a library for generating PDF on the fly, avilable at http:// www.pdflib.com, is vulnerable to multiple bufferoverflows due to a misuse of strcpy(). An attacker can exploit this issue to execute arbitrary code or to crash the application that uses the library. One of the vulnerable functions is pdc_fsearch_fopen() that is called, for example, by PDF_load_image() which overflows a stack buffer if a long filename is provided. The php wrapper for pdflib (pecl extension) is also vulnerable so please take care of allowing users to generate custom pdfs from webapps. this is a proof-of-concept that crashes php: <?php ..... PDF_load_image($p,"jpeg",str_repeat("A",1100), null); ?> The developers have been warned and they plained to fix those bugs in the next release. cheers, -poplix http://px.dynalias.org