CVE-2018-20797 An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPre...
MediumCVSS 6.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/libpodofo(Ubuntu:22.04) | < 0.9.7+dfsg-3ubuntu0.1~esm1 | 0.9.7+dfsg-3ubuntu0.1~esm1 |
| debian/libpodofo(Debian:12) | All versions | No fix listed |
| debian/libpodofo(Debian:12) | = 0.9.8+dfsg-3 | No fix listed |
| debian/libpodofo(Debian:12) | = 0.9.8+dfsg-3.1 | No fix listed |
| debian/libpodofo(Debian:12) | = 0.9.8+dfsg-3.1~exp1 | No fix listed |
| debian/libpodofo(Debian:12) | = 0.9.8+dfsg-3.2 | No fix listed |
| debian/libpodofo(Debian:12) | = 0.9.8+dfsg-3.3 | No fix listed |
| debian/libpodofo(Debian:13) | All versions | No fix listed |
| debian/libpodofo(Debian:13) | = 0.9.8+dfsg-3.2 | No fix listed |
| debian/libpodofo(Debian:13) | = 0.9.8+dfsg-3.3 | No fix listed |
| debian/libpodofo(Debian:14) | All versions | No fix listed |
| debian/libpodofo(Debian:14) | = 0.9.8+dfsg-3.2 | No fix listed |
| debian/libpodofo(Debian:14) | = 0.9.8+dfsg-3.3 | No fix listed |
| podofo project podofo | = 0.9.6 | No fix listed |
| alpine/podofo(Alpine:v3.13) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.14) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.15) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.16) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.17) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.18) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.19) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.20) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.21) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.22) | < 0.9.7-r0 | 0.9.7-r0 |
| alpine/podofo(Alpine:v3.23) | < 0.9.7-r0 | 0.9.7-r0 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/podofo(Alpine:v3.24) | < 0.9.7-r0 | 0.9.7-r0 |
References
- Ubuntu CVE tracker vendor-advisory
- USN-7217-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-20797 vendor-advisory
- sourceforge.net exploit third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking