CVE-2017-8787
HighSummary
The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.
Risk Assessment
An attacker could exploit this vulnerability to disrupt the operation of applications processing PDF files, potentially leading to service outages.
Recommendation
It is recommended to update to the latest version of PoDoFo to mitigate the risks associated with this vulnerability.
Other vulnerabilities in PoDoFo 0.9.5
See all- CVE-2017-6844High
Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
- CVE-2017-6843High
A heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to exploit it via a crafted file.
- CVE-2017-5886High
In PoDoFo 0.9.4, there is a heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function, allowing remote attackers to have unspecified impact via a crafted file.
- CVE-2017-5853High
Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
- CVE-2017-8378Critical
Heap-based buffer overflow in the PdfParser::ReadObjects function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- CVE-2015-8981Critical
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
- CVE-2026-54633Medium
In PoDoFo from version 1.0.0 to 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. Additionally, validation of hival uses an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range.
Original NVD description (English source)
The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS