PT-2019-6172 · Podofo+2 · Podofo+2

Tao · Published 2019-04-04 · Updated 2022-11-29 · CVE-2020-18972

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PoDoFo version 0.9.6

Description The issue is related to the exposure of sensitive information to unauthorized actors. It involves the IsNextToken function in the src/base/PdfToenizer.cpp component, which can be exploited by attackers to obtain sensitive information. The vulnerability is associated with the disclosure of information in an error data area, allowing a remote attacker to access confidential data.

Recommendations For PoDoFo version 0.9.6, consider restricting access to the IsNextToken function in the src/base/PdfToenizer.cpp component as a temporary workaround until a patch is available.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ALT-PU-2021-1684

ALT-PU-2022-3234

BDU:2022-01664

CVE-2020-18972

Affected Products

Alt Linux

Debian

Podofo

References · 35

• 🔥 https://sourceforge.net/p/podofo/tickets/49 · Exploit
• https://errata.altlinux.org/ALT-PU-2021-1684 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01664 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-18972 · Security Note
• https://ubuntu.com/security/CVE-2020-18972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-18972 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9687 · Security Note
• https://osv.dev/vulnerability/CVE-2020-18972 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20797 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9199 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-18972 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19532 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-18972 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-18972 · Vendor Advisory