Mageia: 2020-0294 High: PoDoFo Denial Of Service Issues
mageia
July 30, 2020
The updated packages fix security vulnerabilities: A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 c...
Summary
The updated packages fix security vulnerabilities:
A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey()
function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote
attackers to cause a denial-of-service via a crafted pdf file. (CVE-2018-12983)
An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document,
pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be
problematic due to the function GetObject() being called for the pPage NULL
pointer object. The value of pPage at this point is 0x0, which causes a NULL
pointer dereference. (CVE-2018-20751)
PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6
has a NULL pointer dereference that can (for example) be triggered by sending a
crafted PDF file to the podofoimpose binary. It allows an attacker to cause
Denial of Service (Segmentation fault) or possibly have unspecified other impact.
(CVE-2019-9199)
PoDoFo 0.9.6 has a heap-bas...
References
- https://bugs.mageia.org/show_bug.cgi?id=24385
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Y6ZKYPW55PN6XV5XW6KZDIJLWRXON74N/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5Z7UF3AC76HHLSAHVBUQWMYXHR33DR34/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4K6FST3UH3WNUNCIAEEGZJJASCP5ZXUF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SSB4HRLHF7H3DPNTFPTXUE6EGXXZ5JSZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WR6XY3TOLJPLXOGHYPCB42JW3SWRZNY4/
- https://www.cve.org/CVERecord?id=CVE-2018-12983
- https://www.cve.org/CVERecord?id=CVE-2018-20751
- https://www.cve.org/CVERecord?id=CVE-2019-9199
- https://www.cve.org/CVERecord?id=CVE-2019-9687
- https://www.cve.org/CVERecord?id=CVE-2019-20093
Resolution
SRPMS
- 7/core/podofo-0.9.6-1.1.mga7
PREVIOUS
NEXT
Publication date: 30 Jul 2020
URL: https://advisories.mageia.org/MGASA-2020-0294.html
Type: security
CVE: CVE-2018-12983,
CVE-2018-20751,
CVE-2019-9199,
CVE-2019-9687,
CVE-2019-20093
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!