PT-2018-18370 · Podofo+1 · Podofo+1

Mattia Rizzolo · Published 2018-03-09 · Updated 2020-08-24 · CVE-2018-8000

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PoDoFo version 0.9.5

Description: A heap-based buffer overflow issue exists in the GetNextToken() function of PoDoFo::PdfTokenizer in PdfTokenizer.cpp. This could allow remote attackers to cause a denial-of-service or potentially execute arbitrary code via a crafted pdf file.

Recommendations: For PoDoFo version 0.9.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2018-2273

CVE-2018-8000

Affected Products

Alt Linux

Podofo

References · 47

• 🔥 https://sourceforge.net/p/podofo/tickets/13 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1548918 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7383 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6841 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8001 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7382 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8000 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7378 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6842 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7381 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7994 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5783 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5295 · Security Note