CVE-2017-8378

CVE-2017-8378 affects PoDoFo up to version 0.9.5, with a heap-based buffer overflow in PdfParser::ReadObjects (base/PdfParser.cpp) potentially allowing a remote attacker to crash the application (denial of service) or cause other impact via vectors related to m_offsets.size. Connected advisories(...

CVE-2017-6844

PoDoFo 0.9.4 contains a buffer overflow in PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp) that can be triggered by a crafted PDF to achieve unspecified impact. Multiple connected advisories indicate fixes were released (e.g., openSUSE/SUSE-SU-2018:2481-1 and Fedora openSUSE updates) to add...

CVE-2017-8054

CVE-2017-8054 affects PoDoFo up to version 0.9.6 (PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464) and can be exploited by a crafted PDF to cause a denial of service via infinite recursion or crash. Multiple advisories (SUSE/openSUSE, SUSE-SU updates, and related Nessus entries) fix thi...

CVE-2017-5886

CVE-2017-5886 is a PoDoFo heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken (PdfTokenizer.cpp) affecting PoDoFo 0.9.4. The vulnerability allows a crafted PDF file to cause a denial of service or related impact; exploitation details are not provided in the initial document. Connecte...

CVE-2018-5309

CVE-2018-5309 affects PoDoFo up to version 0.9.5, where an integer overflow in PdfObjectStreamParserObject::ReadObjectsFromStream (base/PdfObjectStreamParserObject.cpp) could allow remote attackers to cause a denial-of-service via a crafted PDF. Public detail across multiple connected advisories ...

CVE-2017-7378

CVE-2017-7378 affects PoDoFo 0.9.5, where PoDoFo::PdfPainter::ExpandTabs can be triggered by a crafted PDF to cause a heap-based buffer over-read and application crash (denial of service). OpenSUSE/SUSE advisories indicate this issue was addressed in PoDoFo 0.9.6 and list CVE-2017-7378 among fixe...

CVE-2018-5295

CVE-2018-5295 affects PoDoFo 0.9.5, where an integer overflow in PdfXRefStreamParserObject::ParseStream could allow remote attackers to cause a denial of service via a crafted PDF. Public references in connected advisories confirm PoDoFo parsing-related overflow as the root cause. Several vendor ...

CVE-2017-6845

CVE-2017-6845 affects PoDoFo 0.9.4: The PoDoFo::PdfColor::operator function in PdfColor.cpp allows a crafted PDF to trigger a NULL pointer dereference, causing denial of service. OpenSUSE/SUSE advisories document the flaw and list patched releases (e.g., PoDoFo 0.9.6) that fix NULL pointer derefe...

CVE-2019-20093

Summary: CVE-2019-20093 affects PoDoFo up to version 0.9.6. The vulnerability exists in the DelayedLoad path of PoDoFo::PdfVariant, specifically PdfVariant.h and ImageExtractor.cpp, where processing a crafted PDF can trigger a NULL pointer dereference, resulting in a denial of service. The issue ...

CVE-2018-8001

CVE-2018-8001 affects PoDoFo 0.9.5 where UnescapeName() in PdfName.cpp contains a heap-based buffer over-read, enabling remote attackers to trigger a denial-of-service through a crafted PDF. Public advisories (openSUSE/SUSE) document fixes in PoDoFo 0.9.6 and later, and list CVE-2018-8001 among m...

CVE-2017-7380

PoDoFo 0.9.5 is affected by CVE-2017-7380 through a NULL pointer dereference in PdfPage.cpp:614:20, which can lead to a denial of service via a crafted PDF document (application crash). Exploitation or in-the-wild details are not provided in the documents. Remediation is through vendor updates: S...

CVE-2017-8787

CVE-2017-8787 affects PoDoFo 0.9.5 and targets the ReadXRefStreamEntry path in PoDoFo::PdfXRefStreamParserObject.cpp, causing a heap-based buffer over-read when processing crafted PDFs, with potential denial of service or other impact. Publicly documented fixes are included in PoDoFo 0.9.6, as re...

CVE-2017-7994

The CVE concerns PoDoFo 0.9.5, where TextExtractor::ExtractText can be triggered by a crafted PDF to cause a NULL pointer dereference and application crash (denial of service). Several advisories note this vulnerability among a broader set fixed in PoDoFo 0.9.6 (e.g., openSUSE/SUSE updates for po...

CVE-2017-7379

CVE-2017-7379 affects PoDoFo 0.9.5’s PdfSimpleEncoding::ConvertToEncoding in PdfEncoding.cpp, permitting a crafted PDF to trigger a heap-based buffer over-read and application crash (denial of service). Connected advisories confirm the issue and list the patch status for Linux distros (e.g., open...

CVE-2017-6847

CVE-2017-6847 affects the PoDoFo library (PoDoFo 0.9.4) and is caused by a NULL pointer dereference in the DelayedLoad function of PdfVariant.h when processing crafted PDFs. Publicly referenced advisories in connected documents confirm the issue is fixed in subsequent PoDoFo updates (e.g., openSU...

CVE-2018-5296

PoDoFo 0.9.5 is vulnerable due to an uncontrolled memory allocation in PdfParser::ReadXRefSubsection (base/PdfParser.cpp), which could allow remote attackers to cause a denial-of-service via a crafted PDF. This CVE (CVE-2018-5296) is reflected in multiple sources (NVD entry and vendor advisories)...

CVE-2018-5308

CVE-2018-5308 affects PoDoFo 0.9.5 and is due to undefined behavior in PdfMemoryOutputStream::Write caused by improper handling of memcpy arguments. Exploitation could lead to denial of service via crafted PDFs. Multiple connected advisories confirm the fix was introduced in PoDoFo 0.9.6 (and rel...

CVE-2017-5854

CVE-2017-5854 affects PoDoFo 0.9.4, where base/PdfOutputStream.cpp is vulnerable to a crafted PDF causing a NULL pointer dereference and denial of service. Public advisories (SUSE-SU-2018:2481-1 and OpenSUSE/OpenSUSE-2019-66) document the fix by upgrading PoDoFo and addressing the NULL dereferenc...

CVE-2017-6840

The CVE-2017-6840 issue affects PoDoFo 0.9.5: ColorChanger::GetColorFromStack in colorchanger.cpp allows an invalid read leading to a denial of service when processing a crafted file. Connected advisories (SUSE/OpenSUSE) note a fix for this vulnerability in PoDoFo, indicating remediation via upda...

CVE-2017-5852

The CVE-2017-5852 entry concerns PoDoFo 0.9.4: PoDoFo::PdfPage::GetInheritedKeyFromObject in base/PdfVariant.cpp can cause a denial of service via crafted PDFs (infinite loop). Public advisories confirm patches in newer PoDoFo releases (e.g., openSUSE/SUSE updates shipping PoDoFo 0.9.6) to addres...

CVE-2017-5855

PoDoFo 0.9.4 contains a NULL pointer dereference in PoDoFo::PdfParser::ReadXRefSubsection when processing a crafted PDF, enabling denial of service. OpenSUSE/SUSE advisories fix this by upgrading to a newer PoDoFo (e.g., 0.9.6) or applying patches that address CVE-2017-5855. No exploit details or...

CVE-2017-5853

CVE-2017-5853 affects the PoDoFo library (PoDoFo 0.9.4) due to a signed/integer overflow in base/PdfParser.cpp, which could allow a remote attacker to impact the host via a crafted PDF file. Public advisories tied to this CVE (e.g., openSUSE/SUSE SU-2018:2481-1 and related Fedora advisories) indi...

CVE-2018-8002

CVE-2018-8002 affects PoDoFo 0.9.5. The vulnerability is an infinite loop in PdfParserObject::ParseFileComplete() (PdfParserObject.cpp) that can cause a stack overflow, enabling a remote attacker to trigger denial of service via a crafted PDF. Connected sources corroborate the issue across multip...

CVE-2018-20751

CVE-2018-20751 affects PoDoFo 0.9.6, where crop_page() can dereference a NULL pPage pointer when adding MediaBox to a crafted PDF, potentially crashing the application. Several connected advisories confirm PoDoFo 0.9.6 as vulnerable and that the issue is fixed in PoDoFo 0.9.7. The broader podofo ...

CVE-2019-9199

PoDoFo 0.9.6 contains a NULL pointer dereference in PoDoFo::Impose::PdfTranslator::setSource() (pdftranslator.cpp) that can be triggered by a crafted PDF via podofoimpose, leading to Denial of Service (segmentation fault) and potential other impact. The issue has been fixed in PoDoFo 0.9.7, as no...

CVE-2017-7382

CVE-2017-7382 is tied to PoDoFo 0.9.5, where PdfFontFactory.cpp:200:88 contains a NULL pointer dereference that can crash the application via a crafted PDF document (DoS). The Connected documents confirm PoDoFo context and affected version, but do not provide a concrete remediation version or pat...

CVE-2018-5783

CVE-2018-5783 affects the PoDoFo library (PoDoFo 0.9.5) where an uncontrolled memory allocation in the function PoDoFo::PdfVecObjects::Reserve (base/PdfVecObjects.h) could allow remote attackers to cause a denial of service with a crafted PDF. The issue is mitigated by upgrading to PoDoFo 0.9.7, ...

CVE-2021-30469

CVE-2021-30469 affects PoDoFo 0.9.7. The issue is a use-after-free in PoDoFo::PdfVecObjects::Clear(), which can lead to a denial of service when processing a crafted PDF file. The connected documents corroborate the same description; no explicit exploit details or patches are provided in the sour...

CVE-2018-12983

CVE-2018-12983 affects PoDoFo: a stack-based buffer over-read in PdfEncryptMD5Base::ComputeEncryptionKey() (PdfEncrypt.cpp) in PoDoFo 0.9.6-rc1 can be exploited remotely via a crafted PDF to cause a denial of service. Multiple advisories confirm a PoDoFo memory-handling issue leading to DoS when ...

CVE-2021-30471

CVE-2021-30471 affects PoDoFo 0.9.7. The vulnerability is an uncontrolled recursive call in PdfNamesTree::AddToDictionary (src/podofo/doc/PdfNamesTree.cpp) that can lead to a stack overflow. Public references in the connected docs corroborate this issue across multiple feeds (NVD entry and OSV/CV...

CVE-2017-7381

CVE-2017-7381 affects PoDoFo 0.9.5 where the PdfPage.cpp:609:23 code path allows a crafted PDF to trigger a NULL pointer dereference, leading to a denial of service. Public references in the provided connected docs confirm the flaw exists in PoDoFo and that multiple advisories (e.g., SUSE SU-2019...

CVE-2018-11256

PoDoFo 0.9.6 (and earlier 0.9.5) is affected by CVE-2018-11256: PdfDocument::Append() can be exploited by a crafted PDF to trigger a NULL pointer dereference, crashing the application and causing a denial of service. Multiple connected sources confirm the issue in PoDoFo 0.9.5/0.9.6 and state the...

CVE-2017-8053

CVE-2017-8053 concerns PoDoFo 0.9.5 and describes a denial-of-service via a crafted PDF that triggers infinite recursion and excessive stack usage in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser.cpp). The connected documents also reference PoDoFo-related updates and Debian/Ubuntu/Nessus/Op...

CVE-2018-11254

PoDoFo vulnerability set in PoDoFo 0.9.5–0.9.6 enabling denial of service through crafted PDFs, stemming from multiple issues. The primary CVE in this cluster is CVE-2017-8054 (GetPageNodeFromArray/recursive DoS) and CVE-2018-11254 (Excessive Recursion in PdfPagesTree::GetPageNode). Other CVEs (2...

CVE-2021-30470

CVE-2021-30470 affects PoDoFo 0.9.7. A flaw in PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant(), and PdfTokenizer::ReadDataType() allows an uncontrolled recursive call, which can cause a stack overflow. Documented impact in CVSS terms shows availability impact at HIGH (CVSS3.1) with LOCA...

CVE-2018-20797

CVE-2018-20797 affects PoDoFo 0.9.6 where an attempted excessive memory allocation occurs in PoDoFo::podofo_calloc invoked from PdfPredictorDecoder in base/PdfFiltersPrivate.cpp. Connected sources reiter the issue and note fixes in later advisories (e.g., SUSE and OSV entries) indicating the vuln...

CVE-2019-10723

CVE-2019-10723 affects PoDoFo 0.9.6 via PdfPagesTreeCache.cpp, where an attempted memory allocation is excessive because nInitialSize is not validated. This memory handling issue could lead to a denial of service or resource exhaustion on affected systems. Several advisories document the same CVE...

CVE-2018-11255

CVE-2018-11255 affects PoDoFo library (notably PoDoFo 0.9.5/0.9.6). The issue is a NULL pointer dereference in PdfPage::GetPageNumber() triggered by a crafted PDF, leading to a denial of service (crash). Vendor advisories and Nessus/SUSE entries confirm fixed in PoDoFo 0.9.7+. Remediation: upgrad...

CVE-2018-8000

CVE-2018-8000 affects PoDoFo 0.9.5; a heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken() (PdfTokenizer.cpp) could enable denial of service or arbitrary code execution via a crafted PDF. Connected advisories (Ubuntu/SUSE/Fedora) list PoDoFo patches addressing this and related issue...

CVE-2017-6843

CVE-2017-6843 describes a heap-based buffer overflow in PoDoFo 0.9.4, specifically PoDoFo::PdfVariant::DelayedLoad in PdfVariant.h, exploitable by a crafted file. The initial description lists the impact as unspecified; no remediation or patch details are provided in the supplied documents.

CVE-2017-6848

CVE-2017-6848 affects PoDoFo 0.9.5 where PoDoFo::PdfXObject::PdfXObject can be triggered by a crafted PDF file to cause a NULL pointer dereference leading to a denial of service. The description specifies a remote denial of service via crafted input. No explicit remediation or patched version is ...

CVE-2017-7383

CVE-2017-7383 affects PoDoFo 0.9.5. The vulnerability is a NULL pointer dereference in PdfFontFactory.cpp:195:62 that can be triggered by a crafted PDF, causing a denial of service. The provided documents do not specify affected platforms beyond PoDoFo 0.9.5, nor any patch/version that fixes it. ...

CVE-2018-19532

PoDoFo 0.9.6 is affected by a NULL pointer dereference in PdfTranslator::setTarget() when creating PdfXObject (CVE-2018-19532). Exploitation leads to Denial of Service. Upstream fix exists in PoDoFo 0.9.7; affected systems should upgrade to 0.9.7 or apply vendor patches. Connected advisories (Arc...

CVE-2021-30472

CVE-2021-30472 affects PoDoFo 0.9.7. A stack-based buffer overflow is possible in PdfEncryptMD5Base::ComputeOwnerKey (PdfEncrypt.cpp) due to an improper check of the keyLength value. Documented across multiple feeds (NVD entry, CNVD/OSV entries, OSV Ubuntu/Debian, Alpine Linux, Nessus plugin) wit...

CVE-2018-6352

PoDoFo 0.9.5 contains a denial-of-service vulnerability in the PdfParser::ReadObjectsInternal function (base/PdfParser.cpp) caused by excessive iteration on crafted PDF files. This affects PoDoFo 0.9.5 as described in CVE-2018-6352 and is reflected across multiple sources (NVD and CNVD entries). ...

CVE-2019-9687

PoDoFo 0.9.6 is affected by CVE-2019-9687 due to a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 (base/PdfString.cpp). The issue can crash the application and, per archived advisories, may allow arbitrary code execution. The vulnerability has been fixed in PoDoFo 0.9.7 (upstream) an...

CVE-2018-12982

PoDoFo 0.9.6-rc1 contains an invalid memory read in PdfVariant::DelayedLoad(), which can cause a Denial of Service via a crafted PDF. This issue is explicitly fixed in PoDoFo v0.9.7 (upstream) and is addressed in several advisories (e.g., Arch Linux ASA-202101-36; SUSE SU-2019-1849-1) by upgradin...

CVE-2017-6849

CVE-2017-6849 affects PoDoFo 0.9.4, where PoDoFo::PdfColorGray::~PdfColorGray can cause a denial of service via a crafted PDF file due to a NULL pointer dereference. The vulnerability is confirmed in multiple OSV and security-advisory records tied to PoDoFo, including SUSE advisories that list CV...

CVE-2017-6846

The CVE-2017-6846 entry concerns PoDoFo 0.9.4: the GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function may dereference a NULL pointer via a crafted file, leading to denial of service. The vulnerability is triggered by processing malicious PDFs and results in a crash/DOs withou...

CVE-2018-14320

PoDoFo 0.9.6 is vulnerable to CVE-2018-14320 through PdfEncoding::ParseToUnicode due to improper validation, enabling memory corruption that can lead to arbitrary code execution (with user interaction required). The issue can also cause information disclosure and denial depending on exploitation ...