CVE-2021-30470 — Uncontrolled Recursion in Project Podofo

CWE-674 — Uncontrolled Recursion6 documents5 sources
Severity
5.5MEDIUMNVD
OSV7.8
EPSS
0.1%
top 71.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Debian LibpodofoPodofo Project PodofoFedoraproject Fedora+1 more
Timeline
PublishedMay 26
Latest updateJan 20

Description

A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType() functions can lead to a stack overflow.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/libpodofo< libpodofo 0.9.8+dfsg-1 (bookworm)
▶CVEListV5podofo_project/podofoPoDoFo 0.9.7

Also affects: Fedora 33, Enterprise Linux 7.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
OSV
libpodofo vulnerabilities↗2025-01-20
▶
GHSA
GHSA-wx32-7cg6-9x4f: A flaw was found in PoDoFo 0↗2022-05-24
▶
OSV
CVE-2021-30470: A flaw was found in PoDoFo 0↗2021-05-26
▶

📋Vendor Advisories

2
Ubuntu
PoDoFo library vulnerabilities↗2025-01-20
▶
Debian
CVE-2021-30470: libpodofo - A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokeni...↗2021
▶
CVE-2021-30470 — Uncontrolled Recursion | cvebase