Описание
The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libpodofo | fixed | 0.9.5-9 | package | |
| libpodofo | no-dsa | stretch | package | |
| libpodofo | no-dsa | jessie | package | |
| libpodofo | no-dsa | wheezy | package |
Примечания
The motivation for no-dsa in wheezy is that there are no known
services that use this library (apart from desktop applications)
and the worst case is a DoS.
https://www.openwall.com/lists/oss-security/2017/03/02/6
https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp
upstream commit: https://sourceforge.net/p/podofo/code/1892
Связанные уязвимости
The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
