PT-2021-6537 · Podofo+4 · Podofo+4

Mattia Rizzolo · Published 2021-04-21 · Updated 2025-01-20 · CVE-2020-18971

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PoDoFo version 0.9.6

Description The issue is related to a stack-based buffer overflow in the src/base/PdfDictionary.cpp component, specifically at line 65. This allows attackers to cause a denial of service. The vulnerability is associated with a buffer overflow, which can be exploited by a remote attacker to disrupt service.

Recommendations For PoDoFo version 0.9.6, consider applying a patch or fix that addresses the buffer overflow issue in the src/base/PdfDictionary.cpp component to prevent denial of service attacks. As a temporary workaround, restrict access to the vulnerable component to minimize the risk of exploitation.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2021-1684

ALT-PU-2022-3234

BDU:2022-01797

CVE-2020-18971

USN-7217-1

Affected Products

Alt Linux

Debian

Linuxmint

Podofo

Ubuntu

References · 23

• 🔥 https://sourceforge.net/p/podofo/tickets/48 · Exploit
• https://ubuntu.com/security/CVE-2019-10723 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-18971 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7217-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-18971 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12983 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-18971 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30470 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30471 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-18971 · Security Note
• https://ubuntu.com/security/CVE-2018-11255 · Vendor Advisory