MGASA-2020-0294 - Updated podofo packages fix security vulnerability

Publication date: 30 Jul 2020
Type: security
Affected Mageia releases: 7
CVE: CVE-2018-12983,

The updated packages fix security vulnerabilities:

A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey()
function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote 
attackers to cause a denial-of-service via a crafted pdf file. (CVE-2018-12983)

An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document,
pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be
problematic due to the function GetObject() being called for the pPage NULL
pointer object. The value of pPage at this point is 0x0, which causes a NULL
pointer dereference. (CVE-2018-20751)

PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6
has a NULL pointer dereference that can (for example) be triggered by sending a
crafted PDF file to the podofoimpose binary. It allows an attacker to cause
Denial of Service (Segmentation fault) or possibly have unspecified other impact.

PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in
base/PdfString.cpp. (CVE-2019-9687)

The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows
remote attackers to cause a denial of service (NULL pointer dereference) via a
crafted file, because of ImageExtractor.cpp. (CVE-2019-20093)

-[email protected]/thread/Y6ZKYPW55PN6XV5XW6KZDIJLWRXON74N/
-[email protected]/thread/5Z7UF3AC76HHLSAHVBUQWMYXHR33DR34/
-[email protected]/thread/4K6FST3UH3WNUNCIAEEGZJJASCP5ZXUF/
-[email protected]/thread/SSB4HRLHF7H3DPNTFPTXUE6EGXXZ5JSZ/
-[email protected]/thread/WR6XY3TOLJPLXOGHYPCB42JW3SWRZNY4/

- 7/core/podofo-0.9.6-1.1.mga7