PT-2023-18484 · Podofo · Podofo

Daisypo · Published 2023-04-22 · Updated 2025-02-04 · CVE-2023-2241

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PoDoFo version 0.10.0

Description A critical vulnerability was found in PoDoFo, affecting the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack must be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, it is recommended to apply a patch, specifically the one identified as 535a786f124b739e3c857529cecc29e4eeb79778. As a temporary workaround, consider disabling the readXRefStreamEntry function until a patch is available. Restrict access to the PdfXRefStreamParserObject.cpp file to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-122

CWE-787

Related Identifiers

CVE-2023-2241

Affected Products

Podofo

References · 15

• 🔥 https://github.com/podofo/podofo/issues/69 · Exploit
• 🔥 https://github.com/podofo/podofo/files/11260976/poc-file.zip · Exploit
• https://github.com/podofo/podofo/commit/535a786f124b739e3c857529cecc29e4eeb79778 · Patch
• https://osv.dev/vulnerability/CVE-2023-2241 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-2241 · Security Note
• https://ubuntu.com/security/CVE-2023-2241 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2241 · Security Note
• https://t.me/cibsecurity/62661 · Telegram Post
• https://t.me/cvenotify/49402 · Telegram Post
• https://t.me/cvenotify/60218 · Telegram Post
• https://vuldb.com/?ctiid.227226 · Note
• https://t.me/cvenotify/59911 · Telegram Post
• https://t.me/cvenotify/109904 · Telegram Post
• https://vuldb.com/?id.227226 · Note