CVE-2017-8378
CriticalSummary
Heap-based buffer overflow in the PdfParser::ReadObjects function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Risk Assessment
Attackers may exploit this vulnerability to remotely trigger application crashes, leading to service availability interruptions.
Recommendation
It is recommended to update PoDoFo to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access attempts.
Other vulnerabilities in PoDoFo 0.9.5
See all- CVE-2017-8787High
The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.
- CVE-2017-6844High
Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
- CVE-2017-6843High
A heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to exploit it via a crafted file.
- CVE-2017-5886High
In PoDoFo 0.9.4, there is a heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function, allowing remote attackers to have unspecified impact via a crafted file.
- CVE-2017-5853High
Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
- CVE-2015-8981Critical
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
- CVE-2026-54633Medium
In PoDoFo from version 1.0.0 to 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. Additionally, validation of hival uses an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range.
Original NVD description (English source)
Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors related to m_offsets.size.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS