CVE-2017-5886
HighSummary
In PoDoFo 0.9.4, there is a heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function, allowing remote attackers to have unspecified impact via a crafted file.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or destabilize the system, posing a significant security risk to the organization.
Recommendation
It is recommended to update PoDoFo to the latest version to mitigate this vulnerability and to monitor systems for suspicious files.
Other vulnerabilities in PoDoFo 0.9.4
See all- CVE-2017-8787High
The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.
- CVE-2017-6844High
Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
- CVE-2017-6843High
A heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to exploit it via a crafted file.
- CVE-2017-5853High
Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
- CVE-2017-8378Critical
Heap-based buffer overflow in the PdfParser::ReadObjects function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- CVE-2015-8981Critical
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Original NVD description (English source)
Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.