CVE-2018-5296 — Allocation of Resources Without Limits or Throttling in Project Podofo
Severity
5.5MEDIUMNVD
EPSS
0.4%
top 40.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 8
Latest updateMay 13
Description
In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages2 packages
🔴Vulnerability Details
2📋Vendor Advisories
1Debian▶
CVE-2018-5296: libpodofo - In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::Re...↗2018
💬Community
3Bugzilla▶
CVE-2018-6352 mingw-podofo: podofo: Excessive iteration in PdfParser::ReadObjectsInternal function in src/base/PdfParser.cpp [fedora-all]↗2018-01-29
Bugzilla▶
CVE-2018-6352 podofo: Excessive iteration in PdfParser::ReadObjectsInternal function in src/base/PdfParser.cpp [fedora-all]↗2018-01-29
Bugzilla▶
CVE-2017-8378 CVE-2017-7994 CVE-2017-8053 CVE-2017-8054 CVE-2017-8787 CVE-2018-5295 CVE-2018-5296 podofo: Multiple security vulnerabilities↗2017-04-25