PT-2024-29894 · Pdfio+1 · Pdfio+1

Bshyuunn + 3 · Published 2024-08-06 · Updated 2024-08-12 · CVE-2024-42358

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PDFio versions prior to 1.3.1

Description The issue concerns a denial of service (DOS) vulnerability in the TTF parser of the PDFio library. Maliciously crafted TTF files can cause the program to utilize 100% of the memory and enter an infinite loop, potentially leading to a heap-buffer-overflow vulnerability. This occurs due to the nGroups value extracted from the file, which, when altered, can cause the program to consume excessive memory and enter an infinite loop. The read camp function is specifically affected by this issue. Automated systems, including web servers using this library to convert PDF submissions into plaintext, are vulnerable to DOS attacks if an attacker uploads a malicious TTF file.

Recommendations For versions prior to 1.3.1, upgrade to release version 1.3.1 to address the issue. As a temporary workaround, consider restricting the upload of TTF files or implementing additional validation checks on nGroups values to prevent excessive memory usage and infinite loops. Avoid using the ttf.h library until the issue is resolved.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2024-42358

GHSA-4HH9-J68X-8353

Affected Products

Debian

Pdfio

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42358.json · Exploit
• 🔥 https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-4hh9-j68x-8353 · Exploit
• https://github.com/michaelrsweet/pdfio/commit/e4e1c39578279386b0ab9f9ac14b20a8bad4f935 · Patch
• https://cve.org/CVERecord?id=CVE-2024-42358 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42358 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42358 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-42358 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-42358 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42358 · Vendor Advisory
• https://t.me/cvenotify/90153 · Telegram Post
• https://t.me/cvedetector/2622 · Telegram Post