PoDoFo 0.9.4 vulnerabilities

The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.

Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.

A heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to exploit it via a crafted file.

In PoDoFo 0.9.4, there is a heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function, allowing remote attackers to have unspecified impact via a crafted file.

Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.

Heap-based buffer overflow in the PdfParser::ReadObjects function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.

In PoDoFo from version 1.0.0 to 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. Additionally, validation of hival uses an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range.