Advisories ยป MGASA-2020-0294

Updated podofo packages fix security vulnerability

Publication date: 30 Jul 2020
Modification date: 27 Jul 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2018-12983 , CVE-2018-20751 , CVE-2019-9199 , CVE-2019-9687 , CVE-2019-20093

Description

The updated packages fix security vulnerabilities:

A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey()
function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote 
attackers to cause a denial-of-service via a crafted pdf file. (CVE-2018-12983)

An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document,
pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be
problematic due to the function GetObject() being called for the pPage NULL
pointer object. The value of pPage at this point is 0x0, which causes a NULL
pointer dereference. (CVE-2018-20751)

PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6
has a NULL pointer dereference that can (for example) be triggered by sending a
crafted PDF file to the podofoimpose binary. It allows an attacker to cause
Denial of Service (Segmentation fault) or possibly have unspecified other impact.
(CVE-2019-9199)

PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in
base/PdfString.cpp. (CVE-2019-9687)

The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows
remote attackers to cause a denial of service (NULL pointer dereference) via a
crafted file, because of ImageExtractor.cpp. (CVE-2019-20093)

References

SRPMS

7/core