Apache PDFBox 1.8.14 / 2.0.10 Denial Of Service Vulnerability

🗓️ 04 Jul 2018 00:00:00Reported by Tobias OspeltType

zdt🔗 0day.today👁 49 Views

Apache PDFBox AFMParser DoS (OOM) Vulnerabilit

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache PDFBox affects Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2018-8036)	15 Apr 202111:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM FileNet Content Manager affected by Apache PDFBox security vulnerability	16 Jan 201920:15	–	ibm
IBM Security Bulletins	Security Bulletin: A Vulnerability in Apache PDFBox Affects Transformation Extender	12 Nov 201819:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability found in fontbox-1.8.1.jarr which is shipped with IBM® Intelligent Operations Center(CVE-2018-8036)	5 Sep 202312:36	–	ibm
IBM Security Bulletins	Security Bulletin: An Apache PDFBox security vulnerability has been identified with the embedded Content Manager used by IBM Business Automation Workflow (CVE-2018-8036)	10 Jul 201921:40	–	ibm
IBM Security Bulletins	Security Bulletin: Apache PDFBox as used in IBM QRadar Incident Forensics is vulnerable to Publicly disclosed vulnerability. (CVE-2018-8036)	3 Dec 201821:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in DITA, Apache Batik, Apache FOP may affect IBM Business Automation Workflow and IBM Case Manager	26 Mar 202503:39	–	ibm
IBM Security Bulletins	Log Analysis Security Bulletin List	1 Sep 202111:04	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosured vulnerability found by vFinder: (All) Apache PDFBox	12 Feb 202114:22	–	ibm
CNVD	Apache PDFBox's AFMParser Denial of Service Vulnerability	4 Jul 201800:00	–	cnvd

[CVE-2018-8036] DoS (OOM) Vulnerability in Apache PDFBox's AFMParser

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache PDFBox 1.8.0 to 1.8.14
Apache PDFBox 2.0.0 to 2.0.10
Earlier, unsupported Apache PDFBox versions may be affected as well

Description:
A carefully crafted (or fuzzed) file can trigger an infinite loop which leads to 
an out of memory exception in Apache PDFBox's AFMParser.

Mitigation:
Upgrade to Apache PDFBox 1.8.15 respectively 2.0.11

Credit:
This issue was discovered by Tobias Ospelt

Website:
https://pdfbox.apache.org/

Download:
https://pdfbox.apache.org/download.cgi
https://www.apache.org/dist/pdfbox/2.0.11/RELEASE-NOTES.txt
https://www.apache.org/dist/pdfbox/1.8.15/RELEASE-NOTES.txt

#  0day.today [2018-07-04]  #

04 Jul 2018 00:00Current

6.3Medium risk

Vulners AI Score6.3

EPSS0.00591