PT-2018-18397 · Apache+1 · Apache Pdfbox+1

Publicado 2018-07-03 · Atualizado 2022-05-13 · CVE-2018-8036

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache PDFBox versions 1.8.0 through 1.8.14 Apache PDFBox versions 2.0.0RC1 through 2.0.10

Description: A carefully crafted file can trigger an infinite loop, leading to an out of memory exception in Apache PDFBox's AFMParser.

Recommendations: For Apache PDFBox versions 1.8.0 through 1.8.14, update to a version outside of this range to resolve the issue. For Apache PDFBox versions 2.0.0RC1 through 2.0.10, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of the AFMParser to minimize the risk of exploitation.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2018-8036

GHSA-J2XQ-PFFF-MVGG

OPENSUSE-SU-2018_2645-1

OPENSUSE-SU-2018_3384-1

OPENSUSE-SU-2024:10622-1

SUSE-SU-2018:2630-1

SUSE-SU-2018:3318-1

SUSE-SU-2018_2630-1

Produtos afetados

Apache Pdfbox

Suse

Referências · 27

• https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540@%3Cdev.syncope.apache.org%3E · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20183318-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8036 · Nota de Segurança
• https://bugzilla.suse.com/1111009 · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20182630-1 · Nota
• https://access.redhat.com/errata/RHSA-2018:2669 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2018/06/29/2 · Nota
• https://bugzilla.suse.com/1099721 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8036 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:2630-1 · Aviso do Fabricante
• https://lists.apache.org/thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6%40%3Cusers.pdfbox.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2018-8036 · Nota
• https://ubuntu.com/security/CVE-2018-8036 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j2xq-pfff-mvgg · Aviso do Fabricante