SB2017030123 - Multiple vulnerabilities in podofo.sourceforge.net podofo

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2017-5854)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted file.

2) NULL pointer dereference (CVE-ID: CVE-2017-5855)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted file.

3) Heap-based buffer overflow (CVE-ID: CVE-2017-5886)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4. A remote attacker can use a crafted file. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Infinite loop (CVE-ID: CVE-2017-5852)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted file.

5) Integer overflow (CVE-ID: CVE-2017-5853)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.openwall.com/lists/oss-security/2017/02/01/14
• http://www.openwall.com/lists/oss-security/2017/02/02/12
• http://www.securityfocus.com/bid/96072
• https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-pdfoutputstream-cpp/
• http://www.securityfocus.com/bid/96516
• https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp/
• http://www.securityfocus.com/bid/96512
• https://blogs.gentoo.org/ago/2017/02/03/podofo-heap-based-buffer-overflow-in-podofopdftokenizergetnexttoken-pdftokenizer-cpp/
• http://www.openwall.com/lists/oss-security/2017/02/01/12
• http://www.openwall.com/lists/oss-security/2017/02/02/10
• http://www.securityfocus.com/bid/97032
• https://blogs.gentoo.org/ago/2017/02/01/podofo-infinite-loop-in-podofopdfpagegetinheritedkeyfromobject-pdfpage-cpp/
• http://www.securityfocus.com/bid/96066
• https://blogs.gentoo.org/ago/2017/02/01/podofo-signed-integer-overflow-in-pdfparser-cpp/