NULL pointer dereference in podofo - CVE-2019-20093

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU34932

NULL pointer dereference in podofo - CVE-2019-20093

Published: December 30, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU34932
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-20093
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted file, because of ImageExtractor.cpp.


Affected software

podofo
podofo (Alpine package)
libpodofo0_9_2
libpodofo0_9_2-debuginfo
podofo-debuginfo
podofo-debugsource
libpodofo-devel
podofo
mingw-podofo
libpodofo0_9_6
libpodofo0_9_6-debuginfo
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
openSUSE Leap
Fedora

How to mitigate CVE-2019-20093

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

podofo (Alpine package) - update to 0.9.7-r0
libpodofo0_9_2 - update to 0.9.2-3.12.1
libpodofo0_9_2-debuginfo - update to 0.9.2-3.12.1
podofo-debuginfo - addressed in versions 0.9.2-3.12.1, 0.9.6-150300.3.3.1
podofo-debugsource - addressed in versions 0.9.2-3.12.1, 0.9.6-150300.3.3.1
libpodofo-devel - addressed in versions 0.9.2-3.12.1, 0.9.6-150300.3.3.1
podofo - addressed in versions 0.9.6-9.fc30, 0.9.6-9.fc31
mingw-podofo - addressed in versions 0.9.6-13.fc30, 0.9.6-13.fc31
libpodofo0_9_6 - update to 0.9.6-150300.3.3.1
libpodofo0_9_6-debuginfo - update to 0.9.6-150300.3.3.1
podofo - update to 0.9.6-150300.3.3.1

External References

Related Security Bulletins