{"id":"SUSE-SU-2019:0393-1","summary":"Security update for podofo","details":"This update for podofo fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote\n  attackers to cause a denial of service (NULL pointer dereference) via a crafted\n  file (bsc#1027779).\n- CVE-2018-5308: Properly validate memcpy arguments in the\n  PdfMemoryOutputStream::Write function to prevent remote attackers from causing\n  a denial-of-service or possibly have unspecified other impact via a crafted pdf\n  file (bsc#1075772)\n- CVE-2018-5295: Prevent integer overflow in the\n  PdfXRefStreamParserObject::ParseStream function that allowed remote attackers\n  to cause a denial-of-service via a crafted pdf file (bsc#1075026).\n- CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote\n  attackers to cause a denial of service (NULL pointer dereference) via a crafted\n  file (bsc#1027779).\n- CVE-2018-5309: Prevent integer overflow in the\n  PdfObjectStreamParserObject::ReadObjectsFromStream function that allowed remote\n  attackers to cause a denial-of-service via a crafted pdf file (bsc#1075322).\n- CVE-2018-5296: Prevent uncontrolled memory allocation in the\n  PdfParser::ReadXRefSubsection function that allowed remote attackers to cause a\n  denial-of-service via a crafted pdf file (bsc#1075021).\n- CVE-2017-7381: Prevent NULL pointer dereference that allowed remote attackers\n  to cause a denial of service via a crafted PDF document (bsc#1032020).\n- CVE-2017-7382: Prevent NULL pointer dereference that allowed remote attackers\n  to cause a denial of service via a crafted PDF document (bsc#1032021).\n- CVE-2017-7383: Prevent NULL pointer dereference that allowed remote attackers\n  to cause a denial of service via a crafted PDF document (bsc#1032022).\n- CVE-2018-11256: Prevent NULL pointer dereference that allowed remote\n  attackers to cause a denial of service via a crafted PDF document\n  (bsc#1096889).\n- CVE-2018-5783: Prevent uncontrolled memory allocation in the\n  PoDoFo::PdfVecObjects::Reserve function that allowed remote attackers to cause\n  a denial of service via a crafted pdf file (bsc#1076962).\n\nThese non-security issues were fixed:\n\n- Prevent regression caused by the fix for CVE-2017-8054.\n- Prevent NULL dereferences when 'Kids' array is missing (bsc#1096890)\n- Added to detect cycles and recursions in XRef tables\n","modified":"2026-03-11T07:05:56.321729Z","published":"2019-02-14T13:46:21Z","related":["CVE-2017-6845","CVE-2017-7381","CVE-2017-7382","CVE-2017-7383","CVE-2017-8054","CVE-2018-11256","CVE-2018-5295","CVE-2018-5296","CVE-2018-5308","CVE-2018-5309","CVE-2018-5783"],"upstream":["CVE-2017-6845","CVE-2017-7381","CVE-2017-7382","CVE-2017-7383","CVE-2017-8054","CVE-2018-11256","CVE-2018-5295","CVE-2018-5296","CVE-2018-5308","CVE-2018-5309","CVE-2018-5783"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1027779"},{"type":"REPORT","url":"https://bugzilla.suse.com/1032020"},{"type":"REPORT","url":"https://bugzilla.suse.com/1032021"},{"type":"REPORT","url":"https://bugzilla.suse.com/1032022"},{"type":"REPORT","url":"https://bugzilla.suse.com/1075021"},{"type":"REPORT","url":"https://bugzilla.suse.com/1075026"},{"type":"REPORT","url":"https://bugzilla.suse.com/1075322"},{"type":"REPORT","url":"https://bugzilla.suse.com/1075772"},{"type":"REPORT","url":"https://bugzilla.suse.com/1076962"},{"type":"REPORT","url":"https://bugzilla.suse.com/1096889"},{"type":"REPORT","url":"https://bugzilla.suse.com/1096890"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-6845"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7381"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7382"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7383"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-8054"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-11256"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-5295"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-5296"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-5308"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-5309"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-5783"}],"affected":[{"package":{"name":"podofo","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","purl":"pkg:rpm/suse/podofo&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.6.3"}]}],"ecosystem_specific":{"binaries":[{"libpodofo0_9_2":"0.9.2-3.6.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:0393-1.json"}},{"package":{"name":"podofo","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","purl":"pkg:rpm/suse/podofo&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.6.3"}]}],"ecosystem_specific":{"binaries":[{"libpodofo0_9_2":"0.9.2-3.6.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:0393-1.json"}},{"package":{"name":"podofo","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","purl":"pkg:rpm/suse/podofo&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.6.3"}]}],"ecosystem_specific":{"binaries":[{"libpodofo-devel":"0.9.2-3.6.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:0393-1.json"}},{"package":{"name":"podofo","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","purl":"pkg:rpm/suse/podofo&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.6.3"}]}],"ecosystem_specific":{"binaries":[{"libpodofo-devel":"0.9.2-3.6.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:0393-1.json"}},{"package":{"name":"podofo","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","purl":"pkg:rpm/suse/podofo&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.6.3"}]}],"ecosystem_specific":{"binaries":[{"libpodofo0_9_2":"0.9.2-3.6.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:0393-1.json"}},{"package":{"name":"podofo","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","purl":"pkg:rpm/suse/podofo&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.6.3"}]}],"ecosystem_specific":{"binaries":[{"libpodofo0_9_2":"0.9.2-3.6.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:0393-1.json"}}],"schema_version":"1.7.5"}