Unverified Commit e2c5702e authored by Mattia Rizzolo's avatar Mattia Rizzolo
Browse files

update some libpodofo CVEs 



Signed-off-by: Mattia Rizzolo's avatarMattia Rizzolo <mattia@debian.org>
parent d8327299

data/CVE/list

+4 −1
Original line number Diff line number Diff line
@@ -5823,6 +5823,7 @@ CVE-2018-5295 (In PoDoFo 0.9.5, there is an integer overflow in the ...) 
	[jessie] - libpodofo <no-dsa> (Minor issue)

	[wheezy] - libpodofo <no-dsa> (Minor issue)

	NOTE: upstream thread: https://sourceforge.net/p/podofo/mailman/message/36180168/

	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1889

CVE-2018-5294 (In libming 0.4.8, there is an integer overflow (caused by an ...)

	- ming <removed>

	NOTE: https://github.com/libming/libming/issues/98
@@ -46683,6 +46684,8 @@ CVE-2017-8054 (The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cp 
	NOTE: PoC: https://github.com/qwertwwwe/PoC/blob/master/podofo/PoC

	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1872

	NOTE: partially reverted in: https://sourceforge.net/p/podofo/code/1881

	NOTE: … and re-fixed in: https://sourceforge.net/p/podofo/code/1882

	NOTE: and https://sourceforge.net/p/podofo/code/1883

CVE-2017-8053 (PoDoFo 0.9.5 allows denial of service (infinite recursion and stack ...)

	- libpodofo <unfixed> (bug #860994)

	[stretch] - libpodofo <no-dsa> (Minor issue)
@@ -52278,7 +52281,7 @@ CVE-2017-6845 (The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 
	NOTE: and the worst case is a DoS.

	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/6

	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp

	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1873/

	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1892

CVE-2017-6844 (Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function ...)

	{DLA-929-1}

	- libpodofo 0.9.4-5 (bug #861561)