PoDoFo 0.9.5 Uncontrolled Memory Allocation DoS Vulnerability Analysis

Key Information Summary Vulnerability Overview Vulnerability ID: 1536179 Vulnerability Title: Uncontrolled memory allocation in PoDoFo::PdfVecObjects::Reserve (src/base/PdfVecObjects.h) Description: An uncontrolled memory allocation issue exists in the function of the PoDoFo library. This can be triggered by a specially crafted PDF file, leading to a Denial of Service (DoS). Technical Details Affected Version: PoDoFo 0.9.5 Code Location: Specific Function: Problematic Line: 499 (variable is controllable by external input, leading to excessive memory allocation) Trigger Condition: Use a specific PDF file as input and run Security Impact Attack Surface: Easily exploitable remotely, causing service disruption Severity: High Error Type: Memory issue, specifically Fix and Status Status: Closed (CLOSED EOL) Reason for Closure: EPEL 7 has reached End of Life (EOL) and no longer receives security or bug fix updates Reported Time: 2018-01-18 19:49 UTC Last Modified Time: 2024-07-09 02:16 UTC Last Closed Time: 2024-07-09 02:16:22 UTC Attachments and POC Attachment: Description: Proof-of-concept (POC) to reproduce the vulnerability Related Personnel Reporter: probefuzzer Handler: Dan Horák QA Contact: Fedora Extras Quality Assurance Additional Information Product: Fedora EPEL Component: podofo Environment: epel7

Goal Reached Thanks to every supporter — we hit 100%!

PoDoFo 0.9.5 Uncontrolled Memory Allocation DoS Vulnerability Analysis