Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-11255 (GCVE-0-2018-11255)
Vulnerability from cvelistv5
Published
2018-05-18 19:00
Modified
2024-09-16 16:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=1575502 | Exploit, Issue Tracking, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=1575502 | Exploit, Issue Tracking, Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T08:01:52.810Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2018-05-18T19:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-11255", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-11255", "datePublished": "2018-05-18T19:00:00Z", "dateReserved": "2018-05-18T00:00:00Z", "dateUpdated": "2024-09-16T16:37:39.883Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-11255\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-05-18T19:29:00.553\",\"lastModified\":\"2024-11-21T03:42:59.987\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.\"},{\"lang\":\"es\",\"value\":\"Se ha descubierto un problema en PoDoFo 0.9.5. La funci\u00f3n PdfPage::GetPageNumber() en PdfPage.cpp en PoDoFo 0.9.5 permite que atacantes remotos provoquen una denegaci\u00f3n de servicio (desreferencia de puntero NULL y bloqueo de aplicaci\u00f3n) mediante un documento PDF manipulado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:podofo_project:podofo:0.9.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97220206-1753-49AE-840C-10B84047A0C2\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1575502\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1575502\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]}]}}" } }
suse-su-2019:1849-1
Vulnerability from csaf_suse
Published
2019-07-15 12:47
Modified
2019-07-15 12:47
Summary
Security update for podofo
Notes
Title of the patch
Security update for podofo
Description of the patch
This update for podofo fixes the following issues:
Security issues fixed:
- CVE-2017-8054: Fixed a vulnerability in PdfPagesTree::GetPageNodeFromArray function which could allow
remote attackers to cause Denial of Service (bsc#1035596).
- CVE-2018-5783: Fixed an uncontrolled memory allocation in PdfVecObjects::Reserve function (bsc#1076962).
- CVE-2018-11255: Fixed a null pointer dereference in PdfPage::GetPageNumber() function which could lead
to Denial of Service (bsc#1096890).
- CVE-2018-20751: Fixed a null pointer dereference in crop_page function (bsc#1124357).
- CVE-2018-12982: Fixed an invalid memory read in PdfVariant::DelayedLoad() function which could allow
remote attackers to cause Denial of Service (bsc#1099720).
- Fixed a buffer overflow in TestEncrypt function.
- Fixed a null pointer dereference in PdfTranslator-setTarget function.
- Fixed a heap based buffer overflow PdfVariant:DelayedLoad function.
Patchnames
SUSE-2019-1849,SUSE-SLE-DESKTOP-12-SP4-2019-1849,SUSE-SLE-SDK-12-SP4-2019-1849,SUSE-SLE-WE-12-SP4-2019-1849
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for podofo", "title": "Title of the patch" }, { "category": "description", "text": "This update for podofo fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-8054: Fixed a vulnerability in PdfPagesTree::GetPageNodeFromArray function which could allow \n remote attackers to cause Denial of Service (bsc#1035596).\n- CVE-2018-5783: Fixed an uncontrolled memory allocation in PdfVecObjects::Reserve function (bsc#1076962). \n- CVE-2018-11255: Fixed a null pointer dereference in PdfPage::GetPageNumber() function which could lead\n to Denial of Service (bsc#1096890).\n- CVE-2018-20751: Fixed a null pointer dereference in crop_page function (bsc#1124357).\n- CVE-2018-12982: Fixed an invalid memory read in PdfVariant::DelayedLoad() function which could allow \n remote attackers to cause Denial of Service (bsc#1099720).\n- Fixed a buffer overflow in TestEncrypt function.\n- Fixed a null pointer dereference in PdfTranslator-setTarget function.\n- Fixed a heap based buffer overflow PdfVariant:DelayedLoad function.\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2019-1849,SUSE-SLE-DESKTOP-12-SP4-2019-1849,SUSE-SLE-SDK-12-SP4-2019-1849,SUSE-SLE-WE-12-SP4-2019-1849", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1849-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2019:1849-1", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191849-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2019:1849-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-July/005711.html" }, { "category": "self", "summary": "SUSE Bug 1035596", "url": "https://bugzilla.suse.com/1035596" }, { "category": "self", "summary": "SUSE Bug 1076962", "url": "https://bugzilla.suse.com/1076962" }, { "category": "self", "summary": "SUSE Bug 1096890", "url": "https://bugzilla.suse.com/1096890" }, { "category": "self", "summary": "SUSE Bug 1099720", "url": "https://bugzilla.suse.com/1099720" }, { "category": "self", "summary": "SUSE Bug 1124357", "url": "https://bugzilla.suse.com/1124357" }, { "category": "self", "summary": "SUSE CVE CVE-2017-8054 page", "url": "https://www.suse.com/security/cve/CVE-2017-8054/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-11255 page", "url": "https://www.suse.com/security/cve/CVE-2018-11255/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-12982 page", "url": "https://www.suse.com/security/cve/CVE-2018-12982/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20751 page", "url": "https://www.suse.com/security/cve/CVE-2018-20751/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5783 page", "url": "https://www.suse.com/security/cve/CVE-2018-5783/" } ], "title": "Security update for podofo", "tracking": { "current_release_date": "2019-07-15T12:47:27Z", "generator": { "date": "2019-07-15T12:47:27Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2019:1849-1", "initial_release_date": "2019-07-15T12:47:27Z", "revision_history": [ { "date": "2019-07-15T12:47:27Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.2-3.9.2.aarch64", "product": { "name": "libpodofo-devel-0.9.2-3.9.2.aarch64", "product_id": "libpodofo-devel-0.9.2-3.9.2.aarch64" } }, { "category": "product_version", "name": "libpodofo0_9_2-0.9.2-3.9.2.aarch64", "product": { "name": "libpodofo0_9_2-0.9.2-3.9.2.aarch64", "product_id": "libpodofo0_9_2-0.9.2-3.9.2.aarch64" } }, { "category": "product_version", "name": "podofo-0.9.2-3.9.2.aarch64", "product": { "name": "podofo-0.9.2-3.9.2.aarch64", "product_id": "podofo-0.9.2-3.9.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.2-3.9.2.i586", "product": { "name": "libpodofo-devel-0.9.2-3.9.2.i586", "product_id": "libpodofo-devel-0.9.2-3.9.2.i586" } }, { "category": "product_version", "name": "libpodofo0_9_2-0.9.2-3.9.2.i586", "product": { "name": "libpodofo0_9_2-0.9.2-3.9.2.i586", "product_id": "libpodofo0_9_2-0.9.2-3.9.2.i586" } }, { "category": "product_version", "name": "podofo-0.9.2-3.9.2.i586", "product": { "name": "podofo-0.9.2-3.9.2.i586", "product_id": "podofo-0.9.2-3.9.2.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.2-3.9.2.ppc64le", "product": { "name": "libpodofo-devel-0.9.2-3.9.2.ppc64le", "product_id": "libpodofo-devel-0.9.2-3.9.2.ppc64le" } }, { "category": "product_version", "name": "libpodofo0_9_2-0.9.2-3.9.2.ppc64le", "product": { "name": "libpodofo0_9_2-0.9.2-3.9.2.ppc64le", "product_id": "libpodofo0_9_2-0.9.2-3.9.2.ppc64le" } }, { "category": "product_version", "name": "podofo-0.9.2-3.9.2.ppc64le", "product": { "name": "podofo-0.9.2-3.9.2.ppc64le", "product_id": "podofo-0.9.2-3.9.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.2-3.9.2.s390", "product": { "name": "libpodofo-devel-0.9.2-3.9.2.s390", "product_id": "libpodofo-devel-0.9.2-3.9.2.s390" } }, { "category": "product_version", "name": "libpodofo0_9_2-0.9.2-3.9.2.s390", "product": { "name": "libpodofo0_9_2-0.9.2-3.9.2.s390", "product_id": "libpodofo0_9_2-0.9.2-3.9.2.s390" } }, { "category": "product_version", "name": "podofo-0.9.2-3.9.2.s390", "product": { "name": "podofo-0.9.2-3.9.2.s390", "product_id": "podofo-0.9.2-3.9.2.s390" } } ], "category": "architecture", "name": "s390" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.2-3.9.2.s390x", "product": { "name": "libpodofo-devel-0.9.2-3.9.2.s390x", "product_id": "libpodofo-devel-0.9.2-3.9.2.s390x" } }, { "category": "product_version", "name": "libpodofo0_9_2-0.9.2-3.9.2.s390x", "product": { "name": "libpodofo0_9_2-0.9.2-3.9.2.s390x", "product_id": "libpodofo0_9_2-0.9.2-3.9.2.s390x" } }, { "category": "product_version", "name": "podofo-0.9.2-3.9.2.s390x", "product": { "name": "podofo-0.9.2-3.9.2.s390x", "product_id": "podofo-0.9.2-3.9.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.2-3.9.2.x86_64", "product": { "name": "libpodofo-devel-0.9.2-3.9.2.x86_64", "product_id": "libpodofo-devel-0.9.2-3.9.2.x86_64" } }, { "category": "product_version", "name": "libpodofo0_9_2-0.9.2-3.9.2.x86_64", "product": { "name": "libpodofo0_9_2-0.9.2-3.9.2.x86_64", "product_id": "libpodofo0_9_2-0.9.2-3.9.2.x86_64" } }, { "category": "product_version", "name": "podofo-0.9.2-3.9.2.x86_64", "product": { "name": "podofo-0.9.2-3.9.2.x86_64", "product_id": "podofo-0.9.2-3.9.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP4", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP4", "product_id": "SUSE Linux Enterprise Desktop 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 12 SP4", "product": { "name": "SUSE Linux Enterprise Software Development Kit 12 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-sdk:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Workstation Extension 12 SP4", "product": { "name": "SUSE Linux Enterprise Workstation Extension 12 SP4", "product_id": "SUSE Linux Enterprise Workstation Extension 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-we:12:sp4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libpodofo0_9_2-0.9.2-3.9.2.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP4", "product_id": "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" }, "product_reference": "libpodofo0_9_2-0.9.2-3.9.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.2-3.9.2.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64" }, "product_reference": "libpodofo-devel-0.9.2-3.9.2.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.2-3.9.2.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le" }, "product_reference": "libpodofo-devel-0.9.2-3.9.2.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.2-3.9.2.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x" }, "product_reference": "libpodofo-devel-0.9.2-3.9.2.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.2-3.9.2.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64" }, "product_reference": "libpodofo-devel-0.9.2-3.9.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo0_9_2-0.9.2-3.9.2.x86_64 as component of SUSE Linux Enterprise Workstation Extension 12 SP4", "product_id": "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" }, "product_reference": "libpodofo0_9_2-0.9.2-3.9.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 12 SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-8054", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-8054" } ], "notes": [ { "category": "general", "text": "The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-8054", "url": "https://www.suse.com/security/cve/CVE-2017-8054" }, { "category": "external", "summary": "SUSE Bug 1035596 for CVE-2017-8054", "url": "https://bugzilla.suse.com/1035596" }, { "category": "external", "summary": "SUSE Bug 1094315 for CVE-2017-8054", "url": "https://bugzilla.suse.com/1094315" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-07-15T12:47:27Z", "details": "moderate" } ], "title": "CVE-2017-8054" }, { "cve": "CVE-2018-11255", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-11255" } ], "notes": [ { "category": "general", "text": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-11255", "url": "https://www.suse.com/security/cve/CVE-2018-11255" }, { "category": "external", "summary": "SUSE Bug 1096890 for CVE-2018-11255", "url": "https://bugzilla.suse.com/1096890" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-07-15T12:47:27Z", "details": "low" } ], "title": "CVE-2018-11255" }, { "cve": "CVE-2018-12982", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-12982" } ], "notes": [ { "category": "general", "text": "Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-12982", "url": "https://www.suse.com/security/cve/CVE-2018-12982" }, { "category": "external", "summary": "SUSE Bug 1099720 for CVE-2018-12982", "url": "https://bugzilla.suse.com/1099720" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-07-15T12:47:27Z", "details": "moderate" } ], "title": "CVE-2018-12982" }, { "cve": "CVE-2018-20751", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20751" } ], "notes": [ { "category": "general", "text": "An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage-\u003eGetObject()-\u003eGetDictionary().AddKey(PdfName(\"MediaBox\"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20751", "url": "https://www.suse.com/security/cve/CVE-2018-20751" }, { "category": "external", "summary": "SUSE Bug 1124357 for CVE-2018-20751", "url": "https://bugzilla.suse.com/1124357" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-07-15T12:47:27Z", "details": "moderate" } ], "title": "CVE-2018-20751" }, { "cve": "CVE-2018-5783", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5783" } ], "notes": [ { "category": "general", "text": "In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5783", "url": "https://www.suse.com/security/cve/CVE-2018-5783" }, { "category": "external", "summary": "SUSE Bug 1076962 for CVE-2018-5783", "url": "https://bugzilla.suse.com/1076962" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.9.2.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.9.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-07-15T12:47:27Z", "details": "moderate" } ], "title": "CVE-2018-5783" } ] }
fkie_cve-2018-11255
Vulnerability from fkie_nvd
Published
2018-05-18 19:29
Modified
2024-11-21 03:42
Severity ?
Summary
An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=1575502 | Exploit, Issue Tracking, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=1575502 | Exploit, Issue Tracking, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
podofo_project | podofo | 0.9.5 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:podofo_project:podofo:0.9.5:*:*:*:*:*:*:*", "matchCriteriaId": "97220206-1753-49AE-840C-10B84047A0C2", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document." }, { "lang": "es", "value": "Se ha descubierto un problema en PoDoFo 0.9.5. La funci\u00f3n PdfPage::GetPageNumber() en PdfPage.cpp en PoDoFo 0.9.5 permite que atacantes remotos provoquen una denegaci\u00f3n de servicio (desreferencia de puntero NULL y bloqueo de aplicaci\u00f3n) mediante un documento PDF manipulado." } ], "id": "CVE-2018-11255", "lastModified": "2024-11-21T03:42:59.987", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2018-05-18T19:29:00.553", "references": [ { "source": "cve@mitre.org", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-476" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
gsd-2018-11255
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2018-11255", "description": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "id": "GSD-2018-11255", "references": [ "https://www.suse.com/security/cve/CVE-2018-11255.html", "https://advisories.mageia.org/CVE-2018-11255.html", "https://security.archlinux.org/CVE-2018-11255" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2018-11255" ], "details": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "id": "GSD-2018-11255", "modified": "2023-12-13T01:22:42.001024Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-11255", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:podofo_project:podofo:0.9.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-11255" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-476" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502", "refsource": "MISC", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 1.8, "impactScore": 3.6 } }, "lastModifiedDate": "2018-06-15T19:38Z", "publishedDate": "2018-05-18T19:29Z" } } }
cnvd-2018-10343
Vulnerability from cnvd
Title: PoDoFo拒绝服务漏洞(CNVD-2018-10343)
Description:
PoDoFo是一个开源的、使用C++编写的PDF文件格式的库。
PoDoFo 0.9.5版本中的PdfPage.cpp文件的‘PdfPage::GetPageNumber()’函数存在安全漏洞。远程攻击者可借助特制的PDF文档利用该漏洞造成拒绝服务(空指针逆向引用和应用程序崩溃)。
Severity: 中
Formal description:
厂商尚未提供漏洞修复方案,请关注厂商主页更新: http://podofo.sourceforge.net/
Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11255
Impacted products
Name | PoDoFo PoDoFo 0.9.5 |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2018-11255" } }, "description": "PoDoFo\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u3001\u4f7f\u7528C++\u7f16\u5199\u7684PDF\u6587\u4ef6\u683c\u5f0f\u7684\u5e93\u3002\r\n\r\nPoDoFo 0.9.5\u7248\u672c\u4e2d\u7684PdfPage.cpp\u6587\u4ef6\u7684\u2018PdfPage::GetPageNumber()\u2019\u51fd\u6570\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684PDF\u6587\u6863\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u7a7a\u6307\u9488\u9006\u5411\u5f15\u7528\u548c\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\uff09\u3002", "discovererName": "Zhiyuan Wang of Chengdu Qihoo360 Tech Co. Ltd", "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttp://podofo.sourceforge.net/", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2018-10343", "openTime": "2018-05-28", "products": { "product": "PoDoFo PoDoFo 0.9.5" }, "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-11255", "serverity": "\u4e2d", "submitTime": "2018-05-21", "title": "PoDoFo\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2018-10343\uff09" }
opensuse-su-2024:11178-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
libpodofo-devel-0.9.7-2.2 on GA media
Notes
Title of the patch
libpodofo-devel-0.9.7-2.2 on GA media
Description of the patch
These are all security issues fixed in the libpodofo-devel-0.9.7-2.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11178
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "libpodofo-devel-0.9.7-2.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the libpodofo-devel-0.9.7-2.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-11178", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11178-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5852 page", "url": "https://www.suse.com/security/cve/CVE-2017-5852/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5853 page", "url": "https://www.suse.com/security/cve/CVE-2017-5853/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5854 page", "url": "https://www.suse.com/security/cve/CVE-2017-5854/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5855 page", "url": "https://www.suse.com/security/cve/CVE-2017-5855/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5886 page", "url": "https://www.suse.com/security/cve/CVE-2017-5886/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-6840 page", "url": "https://www.suse.com/security/cve/CVE-2017-6840/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-6844 page", "url": "https://www.suse.com/security/cve/CVE-2017-6844/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-6845 page", "url": "https://www.suse.com/security/cve/CVE-2017-6845/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-6847 page", "url": "https://www.suse.com/security/cve/CVE-2017-6847/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7378 page", "url": "https://www.suse.com/security/cve/CVE-2017-7378/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7379 page", "url": "https://www.suse.com/security/cve/CVE-2017-7379/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7380 page", "url": "https://www.suse.com/security/cve/CVE-2017-7380/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7381 page", "url": "https://www.suse.com/security/cve/CVE-2017-7381/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7382 page", "url": "https://www.suse.com/security/cve/CVE-2017-7382/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7383 page", "url": "https://www.suse.com/security/cve/CVE-2017-7383/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7994 page", "url": "https://www.suse.com/security/cve/CVE-2017-7994/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-8054 page", "url": "https://www.suse.com/security/cve/CVE-2017-8054/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-8787 page", "url": "https://www.suse.com/security/cve/CVE-2017-8787/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-11255 page", "url": "https://www.suse.com/security/cve/CVE-2018-11255/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-11256 page", "url": "https://www.suse.com/security/cve/CVE-2018-11256/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-12982 page", "url": "https://www.suse.com/security/cve/CVE-2018-12982/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-14320 page", "url": "https://www.suse.com/security/cve/CVE-2018-14320/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20751 page", "url": "https://www.suse.com/security/cve/CVE-2018-20751/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5295 page", "url": "https://www.suse.com/security/cve/CVE-2018-5295/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5296 page", "url": "https://www.suse.com/security/cve/CVE-2018-5296/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5308 page", "url": "https://www.suse.com/security/cve/CVE-2018-5308/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5309 page", "url": "https://www.suse.com/security/cve/CVE-2018-5309/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5783 page", "url": "https://www.suse.com/security/cve/CVE-2018-5783/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-8001 page", "url": "https://www.suse.com/security/cve/CVE-2018-8001/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-9687 page", "url": "https://www.suse.com/security/cve/CVE-2019-9687/" } ], "title": "libpodofo-devel-0.9.7-2.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:11178-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.7-2.2.aarch64", "product": { "name": "libpodofo-devel-0.9.7-2.2.aarch64", "product_id": "libpodofo-devel-0.9.7-2.2.aarch64" } }, { "category": "product_version", "name": "libpodofo0_9_7-0.9.7-2.2.aarch64", "product": { "name": "libpodofo0_9_7-0.9.7-2.2.aarch64", "product_id": "libpodofo0_9_7-0.9.7-2.2.aarch64" } }, { "category": "product_version", "name": "podofo-0.9.7-2.2.aarch64", "product": { "name": "podofo-0.9.7-2.2.aarch64", "product_id": "podofo-0.9.7-2.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.7-2.2.ppc64le", "product": { "name": "libpodofo-devel-0.9.7-2.2.ppc64le", "product_id": "libpodofo-devel-0.9.7-2.2.ppc64le" } }, { "category": "product_version", "name": "libpodofo0_9_7-0.9.7-2.2.ppc64le", "product": { "name": "libpodofo0_9_7-0.9.7-2.2.ppc64le", "product_id": "libpodofo0_9_7-0.9.7-2.2.ppc64le" } }, { "category": "product_version", "name": "podofo-0.9.7-2.2.ppc64le", "product": { "name": "podofo-0.9.7-2.2.ppc64le", "product_id": "podofo-0.9.7-2.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.7-2.2.s390x", "product": { "name": "libpodofo-devel-0.9.7-2.2.s390x", "product_id": "libpodofo-devel-0.9.7-2.2.s390x" } }, { "category": "product_version", "name": "libpodofo0_9_7-0.9.7-2.2.s390x", "product": { "name": "libpodofo0_9_7-0.9.7-2.2.s390x", "product_id": "libpodofo0_9_7-0.9.7-2.2.s390x" } }, { "category": "product_version", "name": "podofo-0.9.7-2.2.s390x", "product": { "name": "podofo-0.9.7-2.2.s390x", "product_id": "podofo-0.9.7-2.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libpodofo-devel-0.9.7-2.2.x86_64", "product": { "name": "libpodofo-devel-0.9.7-2.2.x86_64", "product_id": "libpodofo-devel-0.9.7-2.2.x86_64" } }, { "category": "product_version", "name": "libpodofo0_9_7-0.9.7-2.2.x86_64", "product": { "name": "libpodofo0_9_7-0.9.7-2.2.x86_64", "product_id": "libpodofo0_9_7-0.9.7-2.2.x86_64" } }, { "category": "product_version", "name": "podofo-0.9.7-2.2.x86_64", "product": { "name": "podofo-0.9.7-2.2.x86_64", "product_id": "podofo-0.9.7-2.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.7-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64" }, "product_reference": "libpodofo-devel-0.9.7-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.7-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le" }, "product_reference": "libpodofo-devel-0.9.7-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.7-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x" }, "product_reference": "libpodofo-devel-0.9.7-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo-devel-0.9.7-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64" }, "product_reference": "libpodofo-devel-0.9.7-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo0_9_7-0.9.7-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64" }, "product_reference": "libpodofo0_9_7-0.9.7-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo0_9_7-0.9.7-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le" }, "product_reference": "libpodofo0_9_7-0.9.7-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo0_9_7-0.9.7-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x" }, "product_reference": "libpodofo0_9_7-0.9.7-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libpodofo0_9_7-0.9.7-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64" }, "product_reference": "libpodofo0_9_7-0.9.7-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "podofo-0.9.7-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64" }, "product_reference": "podofo-0.9.7-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "podofo-0.9.7-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le" }, "product_reference": "podofo-0.9.7-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "podofo-0.9.7-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x" }, "product_reference": "podofo-0.9.7-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "podofo-0.9.7-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" }, "product_reference": "podofo-0.9.7-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-5852", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-5852" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-5852", "url": "https://www.suse.com/security/cve/CVE-2017-5852" }, { "category": "external", "summary": "SUSE Bug 1023067 for CVE-2017-5852", "url": "https://bugzilla.suse.com/1023067" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-5852" }, { "cve": "CVE-2017-5853", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-5853" } ], "notes": [ { "category": "general", "text": "Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-5853", "url": "https://www.suse.com/security/cve/CVE-2017-5853" }, { "category": "external", "summary": "SUSE Bug 1023069 for CVE-2017-5853", "url": "https://bugzilla.suse.com/1023069" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-5853" }, { "cve": "CVE-2017-5854", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-5854" } ], "notes": [ { "category": "general", "text": "base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-5854", "url": "https://www.suse.com/security/cve/CVE-2017-5854" }, { "category": "external", "summary": "SUSE Bug 1023070 for CVE-2017-5854", "url": "https://bugzilla.suse.com/1023070" }, { "category": "external", "summary": "SUSE Bug 1096890 for CVE-2017-5854", "url": "https://bugzilla.suse.com/1096890" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-5854" }, { "cve": "CVE-2017-5855", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-5855" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-5855", "url": "https://www.suse.com/security/cve/CVE-2017-5855" }, { "category": "external", "summary": "SUSE Bug 1023071 for CVE-2017-5855", "url": "https://bugzilla.suse.com/1023071" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-5855" }, { "cve": "CVE-2017-5886", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-5886" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-5886", "url": "https://www.suse.com/security/cve/CVE-2017-5886" }, { "category": "external", "summary": "SUSE Bug 1023380 for CVE-2017-5886", "url": "https://bugzilla.suse.com/1023380" }, { "category": "external", "summary": "SUSE Bug 1084902 for CVE-2017-5886", "url": "https://bugzilla.suse.com/1084902" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-5886" }, { "cve": "CVE-2017-6840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-6840" } ], "notes": [ { "category": "general", "text": "The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-6840", "url": "https://www.suse.com/security/cve/CVE-2017-6840" }, { "category": "external", "summary": "SUSE Bug 1027787 for CVE-2017-6840", "url": "https://bugzilla.suse.com/1027787" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-6840" }, { "cve": "CVE-2017-6844", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-6844" } ], "notes": [ { "category": "general", "text": "Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-6844", "url": "https://www.suse.com/security/cve/CVE-2017-6844" }, { "category": "external", "summary": "SUSE Bug 1027782 for CVE-2017-6844", "url": "https://bugzilla.suse.com/1027782" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-6844" }, { "cve": "CVE-2017-6845", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-6845" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-6845", "url": "https://www.suse.com/security/cve/CVE-2017-6845" }, { "category": "external", "summary": "SUSE Bug 1027779 for CVE-2017-6845", "url": "https://bugzilla.suse.com/1027779" }, { "category": "external", "summary": "SUSE Bug 1027781 for CVE-2017-6845", "url": "https://bugzilla.suse.com/1027781" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-6845" }, { "cve": "CVE-2017-6847", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-6847" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-6847", "url": "https://www.suse.com/security/cve/CVE-2017-6847" }, { "category": "external", "summary": "SUSE Bug 1027778 for CVE-2017-6847", "url": "https://bugzilla.suse.com/1027778" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-6847" }, { "cve": "CVE-2017-7378", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7378" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7378", "url": "https://www.suse.com/security/cve/CVE-2017-7378" }, { "category": "external", "summary": "SUSE Bug 1032017 for CVE-2017-7378", "url": "https://bugzilla.suse.com/1032017" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7378" }, { "cve": "CVE-2017-7379", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7379" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7379", "url": "https://www.suse.com/security/cve/CVE-2017-7379" }, { "category": "external", "summary": "SUSE Bug 1032018 for CVE-2017-7379", "url": "https://bugzilla.suse.com/1032018" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7379" }, { "cve": "CVE-2017-7380", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7380" } ], "notes": [ { "category": "general", "text": "The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7380", "url": "https://www.suse.com/security/cve/CVE-2017-7380" }, { "category": "external", "summary": "SUSE Bug 1032019 for CVE-2017-7380", "url": "https://bugzilla.suse.com/1032019" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7380" }, { "cve": "CVE-2017-7381", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7381" } ], "notes": [ { "category": "general", "text": "The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7381", "url": "https://www.suse.com/security/cve/CVE-2017-7381" }, { "category": "external", "summary": "SUSE Bug 1032019 for CVE-2017-7381", "url": "https://bugzilla.suse.com/1032019" }, { "category": "external", "summary": "SUSE Bug 1032020 for CVE-2017-7381", "url": "https://bugzilla.suse.com/1032020" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7381" }, { "cve": "CVE-2017-7382", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7382" } ], "notes": [ { "category": "general", "text": "The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7382", "url": "https://www.suse.com/security/cve/CVE-2017-7382" }, { "category": "external", "summary": "SUSE Bug 1032019 for CVE-2017-7382", "url": "https://bugzilla.suse.com/1032019" }, { "category": "external", "summary": "SUSE Bug 1032021 for CVE-2017-7382", "url": "https://bugzilla.suse.com/1032021" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7382" }, { "cve": "CVE-2017-7383", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7383" } ], "notes": [ { "category": "general", "text": "The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7383", "url": "https://www.suse.com/security/cve/CVE-2017-7383" }, { "category": "external", "summary": "SUSE Bug 1032019 for CVE-2017-7383", "url": "https://bugzilla.suse.com/1032019" }, { "category": "external", "summary": "SUSE Bug 1032022 for CVE-2017-7383", "url": "https://bugzilla.suse.com/1032022" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7383" }, { "cve": "CVE-2017-7994", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-7994" } ], "notes": [ { "category": "general", "text": "The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-7994", "url": "https://www.suse.com/security/cve/CVE-2017-7994" }, { "category": "external", "summary": "SUSE Bug 1035534 for CVE-2017-7994", "url": "https://bugzilla.suse.com/1035534" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-7994" }, { "cve": "CVE-2017-8054", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-8054" } ], "notes": [ { "category": "general", "text": "The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-8054", "url": "https://www.suse.com/security/cve/CVE-2017-8054" }, { "category": "external", "summary": "SUSE Bug 1035596 for CVE-2017-8054", "url": "https://bugzilla.suse.com/1035596" }, { "category": "external", "summary": "SUSE Bug 1094315 for CVE-2017-8054", "url": "https://bugzilla.suse.com/1094315" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-8054" }, { "cve": "CVE-2017-8787", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-8787" } ], "notes": [ { "category": "general", "text": "The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-8787", "url": "https://www.suse.com/security/cve/CVE-2017-8787" }, { "category": "external", "summary": "SUSE Bug 1037739 for CVE-2017-8787", "url": "https://bugzilla.suse.com/1037739" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-8787" }, { "cve": "CVE-2018-11255", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-11255" } ], "notes": [ { "category": "general", "text": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-11255", "url": "https://www.suse.com/security/cve/CVE-2018-11255" }, { "category": "external", "summary": "SUSE Bug 1096890 for CVE-2018-11255", "url": "https://bugzilla.suse.com/1096890" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-11255" }, { "cve": "CVE-2018-11256", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-11256" } ], "notes": [ { "category": "general", "text": "An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-11256", "url": "https://www.suse.com/security/cve/CVE-2018-11256" }, { "category": "external", "summary": "SUSE Bug 1096889 for CVE-2018-11256", "url": "https://bugzilla.suse.com/1096889" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-11256" }, { "cve": "CVE-2018-12982", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-12982" } ], "notes": [ { "category": "general", "text": "Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-12982", "url": "https://www.suse.com/security/cve/CVE-2018-12982" }, { "category": "external", "summary": "SUSE Bug 1099720 for CVE-2018-12982", "url": "https://bugzilla.suse.com/1099720" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-12982" }, { "cve": "CVE-2018-14320", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-14320" } ], "notes": [ { "category": "general", "text": "This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5673.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-14320", "url": "https://www.suse.com/security/cve/CVE-2018-14320" }, { "category": "external", "summary": "SUSE Bug 1108764 for CVE-2018-14320", "url": "https://bugzilla.suse.com/1108764" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-14320" }, { "cve": "CVE-2018-20751", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20751" } ], "notes": [ { "category": "general", "text": "An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage-\u003eGetObject()-\u003eGetDictionary().AddKey(PdfName(\"MediaBox\"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20751", "url": "https://www.suse.com/security/cve/CVE-2018-20751" }, { "category": "external", "summary": "SUSE Bug 1124357 for CVE-2018-20751", "url": "https://bugzilla.suse.com/1124357" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-20751" }, { "cve": "CVE-2018-5295", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5295" } ], "notes": [ { "category": "general", "text": "In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5295", "url": "https://www.suse.com/security/cve/CVE-2018-5295" }, { "category": "external", "summary": "SUSE Bug 1075026 for CVE-2018-5295", "url": "https://bugzilla.suse.com/1075026" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-5295" }, { "cve": "CVE-2018-5296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5296" } ], "notes": [ { "category": "general", "text": "In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5296", "url": "https://www.suse.com/security/cve/CVE-2018-5296" }, { "category": "external", "summary": "SUSE Bug 1075021 for CVE-2018-5296", "url": "https://bugzilla.suse.com/1075021" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-5296" }, { "cve": "CVE-2018-5308", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5308" } ], "notes": [ { "category": "general", "text": "PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5308", "url": "https://www.suse.com/security/cve/CVE-2018-5308" }, { "category": "external", "summary": "SUSE Bug 1075772 for CVE-2018-5308", "url": "https://bugzilla.suse.com/1075772" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-5308" }, { "cve": "CVE-2018-5309", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5309" } ], "notes": [ { "category": "general", "text": "In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5309", "url": "https://www.suse.com/security/cve/CVE-2018-5309" }, { "category": "external", "summary": "SUSE Bug 1075322 for CVE-2018-5309", "url": "https://bugzilla.suse.com/1075322" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-5309" }, { "cve": "CVE-2018-5783", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5783" } ], "notes": [ { "category": "general", "text": "In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5783", "url": "https://www.suse.com/security/cve/CVE-2018-5783" }, { "category": "external", "summary": "SUSE Bug 1076962 for CVE-2018-5783", "url": "https://bugzilla.suse.com/1076962" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-5783" }, { "cve": "CVE-2018-8001", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-8001" } ], "notes": [ { "category": "general", "text": "In PoDoFo 0.9.5, there exists a heap-based buffer over-read vulnerability in UnescapeName() in PdfName.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-8001", "url": "https://www.suse.com/security/cve/CVE-2018-8001" }, { "category": "external", "summary": "SUSE Bug 1084894 for CVE-2018-8001", "url": "https://bugzilla.suse.com/1084894" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-8001" }, { "cve": "CVE-2019-9687", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-9687" } ], "notes": [ { "category": "general", "text": "PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-9687", "url": "https://www.suse.com/security/cve/CVE-2019-9687" }, { "category": "external", "summary": "SUSE Bug 1129290 for CVE-2019-9687", "url": "https://bugzilla.suse.com/1129290" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo-devel-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.s390x", "openSUSE Tumbleweed:libpodofo0_9_7-0.9.7-2.2.x86_64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.aarch64", "openSUSE Tumbleweed:podofo-0.9.7-2.2.ppc64le", "openSUSE Tumbleweed:podofo-0.9.7-2.2.s390x", "openSUSE Tumbleweed:podofo-0.9.7-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2019-9687" } ] }
ghsa-qrw2-5jm3-rgfx
Vulnerability from github
Published
2022-05-14 03:18
Modified
2022-05-14 03:18
Severity ?
VLAI Severity ?
Details
An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
{ "affected": [], "aliases": [ "CVE-2018-11255" ], "database_specific": { "cwe_ids": [ "CWE-476" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2018-05-18T19:29:00Z", "severity": "MODERATE" }, "details": "An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.", "id": "GHSA-qrw2-5jm3-rgfx", "modified": "2022-05-14T03:18:03Z", "published": "2022-05-14T03:18:03Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11255" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575502" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…