CVE-2018-8036 Loop with Unreachable Exit Condition in Apache PDFBox
MediumCVSS 6.5
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.pdfbox/pdfbox(Maven) | >= 1.8.0, <= 1.8.14 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | >= 2.0.0RC1, <= 2.0.10 | No fix listed |
| debian/libpdfbox-java(Debian:12) | < 1:1.8.15-1 | 1:1.8.15-1 |
| debian/libpdfbox-java(Debian:14) | < 1:1.8.15-1 | 1:1.8.15-1 |
| debian/libpdfbox-java(Debian:13) | < 1:1.8.15-1 | 1:1.8.15-1 |
| debian/libpdfbox2-java(Debian:12) | < 2.0.11-1 | 2.0.11-1 |
| debian/libpdfbox2-java(Debian:14) | < 2.0.11-1 | 2.0.11-1 |
| debian/libpdfbox2-java(Debian:13) | < 2.0.11-1 | 2.0.11-1 |
| org.apache.pdfbox/pdfbox(Maven) | >= 1.8.0, < 1.8.15 | 1.8.15 |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.10 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.11 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.12 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.13 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.14 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.2 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.3 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.4 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.5 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.6 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.7 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.8 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.9 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | >= 2.0.0RC1, < 2.0.11 | 2.0.11 |
Show 21 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.0-RC1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.0-RC2 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.0-RC3 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.10 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.2 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.3 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.4 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.5 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.6 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.7 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.8 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.9 | No fix listed |
| apache pdfbox | >= 1.8.0, <= 1.8.14 | No fix listed |
| apache pdfbox | >= 2.0.0, <= 2.0.10 | No fix listed |
| apache pdfbox | = 2.0.0-rc1 | No fix listed |
| apache pdfbox | = 2.0.0-rc2 | No fix listed |
| apache pdfbox | = 2.0.0-rc3 | No fix listed |
| Apache PDFBox | = 1.8.0 to 1.8.14 | No fix listed |
| Apache PDFBox | = 2.0.0RC1 to 2.0.10 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2018:2669 third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- www.oracle.com
- github.com
- Debian Security Tracker CVE-2018-8036 vendor-advisory
- bugs.debian.org issue-tracking
- [users] 20180629 [CVE-2018-8036] DoS (OOM) Vulnerability in Apache PDFBox's AFMParser mailing-list
- [syncope-dev] 20200423 Re: Time to cut 2.1.6 / 2.0.15? mailing-list
- FEDORA-2019-6fa01d12b4 vendor-advisory
- FEDORA-2019-9e91afa2be vendor-advisory