Security update for podofo SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0393-1 Final 1 1 2019-02-14T13:46:21Z current 2019-02-14T13:46:21Z 2019-02-14T13:46:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for podofo This update for podofo fixes the following issues: These security issues were fixed: - CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1027779). - CVE-2018-5308: Properly validate memcpy arguments in the PdfMemoryOutputStream::Write function to prevent remote attackers from causing a denial-of-service or possibly have unspecified other impact via a crafted pdf file (bsc#1075772) - CVE-2018-5295: Prevent integer overflow in the PdfXRefStreamParserObject::ParseStream function that allowed remote attackers to cause a denial-of-service via a crafted pdf file (bsc#1075026). - CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1027779). - CVE-2018-5309: Prevent integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function that allowed remote attackers to cause a denial-of-service via a crafted pdf file (bsc#1075322). - CVE-2018-5296: Prevent uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function that allowed remote attackers to cause a denial-of-service via a crafted pdf file (bsc#1075021). - CVE-2017-7381: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1032020). - CVE-2017-7382: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1032021). - CVE-2017-7383: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1032022). - CVE-2018-11256: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1096889). - CVE-2018-5783: Prevent uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function that allowed remote attackers to cause a denial of service via a crafted pdf file (bsc#1076962). These non-security issues were fixed: - Prevent regression caused by the fix for CVE-2017-8054. - Prevent NULL dereferences when 'Kids' array is missing (bsc#1096890) - Added to detect cycles and recursions in XRef tables The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-393,SUSE-SLE-DESKTOP-12-SP3-2019-393,SUSE-SLE-DESKTOP-12-SP4-2019-393,SUSE-SLE-SDK-12-SP3-2019-393,SUSE-SLE-SDK-12-SP4-2019-393,SUSE-SLE-WE-12-SP3-2019-393,SUSE-SLE-WE-12-SP4-2019-393 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ Link for SUSE-SU-2019:0393-1 https://lists.suse.com/pipermail/sle-security-updates/2019-February/005117.html E-Mail link for SUSE-SU-2019:0393-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027779 SUSE Bug 1027779 https://bugzilla.suse.com/1032020 SUSE Bug 1032020 https://bugzilla.suse.com/1032021 SUSE Bug 1032021 https://bugzilla.suse.com/1032022 SUSE Bug 1032022 https://bugzilla.suse.com/1075021 SUSE Bug 1075021 https://bugzilla.suse.com/1075026 SUSE Bug 1075026 https://bugzilla.suse.com/1075322 SUSE Bug 1075322 https://bugzilla.suse.com/1075772 SUSE Bug 1075772 https://bugzilla.suse.com/1076962 SUSE Bug 1076962 https://bugzilla.suse.com/1096889 SUSE Bug 1096889 https://bugzilla.suse.com/1096890 SUSE Bug 1096890 https://www.suse.com/security/cve/CVE-2017-6845/ SUSE CVE CVE-2017-6845 page https://www.suse.com/security/cve/CVE-2017-7381/ SUSE CVE CVE-2017-7381 page https://www.suse.com/security/cve/CVE-2017-7382/ SUSE CVE CVE-2017-7382 page https://www.suse.com/security/cve/CVE-2017-7383/ SUSE CVE CVE-2017-7383 page https://www.suse.com/security/cve/CVE-2017-8054/ SUSE CVE CVE-2017-8054 page https://www.suse.com/security/cve/CVE-2018-11256/ SUSE CVE CVE-2018-11256 page https://www.suse.com/security/cve/CVE-2018-5295/ SUSE CVE CVE-2018-5295 page https://www.suse.com/security/cve/CVE-2018-5296/ SUSE CVE CVE-2018-5296 page https://www.suse.com/security/cve/CVE-2018-5308/ SUSE CVE CVE-2018-5308 page https://www.suse.com/security/cve/CVE-2018-5309/ SUSE CVE CVE-2018-5309 page https://www.suse.com/security/cve/CVE-2018-5783/ SUSE CVE CVE-2018-5783 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Workstation Extension 12 SP3 SUSE Linux Enterprise Workstation Extension 12 SP4 libpodofo-devel-0.9.2-3.6.3 libpodofo0_9_2-0.9.2-3.6.3 podofo-0.9.2-3.6.3 libpodofo0_9_2-0.9.2-3.6.3 as a component of SUSE Linux Enterprise Desktop 12 SP3 libpodofo0_9_2-0.9.2-3.6.3 as a component of SUSE Linux Enterprise Desktop 12 SP4 libpodofo-devel-0.9.2-3.6.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libpodofo-devel-0.9.2-3.6.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libpodofo0_9_2-0.9.2-3.6.3 as a component of SUSE Linux Enterprise Workstation Extension 12 SP3 libpodofo0_9_2-0.9.2-3.6.3 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. CVE-2017-6845 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2017-6845.html CVE-2017-6845 https://bugzilla.suse.com/1027779 SUSE Bug 1027779 https://bugzilla.suse.com/1027781 SUSE Bug 1027781 The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. CVE-2017-7381 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2017-7381.html CVE-2017-7381 https://bugzilla.suse.com/1032019 SUSE Bug 1032019 https://bugzilla.suse.com/1032020 SUSE Bug 1032020 The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. CVE-2017-7382 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2017-7382.html CVE-2017-7382 https://bugzilla.suse.com/1032019 SUSE Bug 1032019 https://bugzilla.suse.com/1032021 SUSE Bug 1032021 The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. CVE-2017-7383 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2017-7383.html CVE-2017-7383 https://bugzilla.suse.com/1032019 SUSE Bug 1032019 https://bugzilla.suse.com/1032022 SUSE Bug 1032022 The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document. CVE-2017-8054 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2017-8054.html CVE-2017-8054 https://bugzilla.suse.com/1035596 SUSE Bug 1035596 https://bugzilla.suse.com/1094315 SUSE Bug 1094315 An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. CVE-2018-11256 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2018-11256.html CVE-2018-11256 https://bugzilla.suse.com/1096889 SUSE Bug 1096889 In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file. CVE-2018-5295 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2018-5295.html CVE-2018-5295 https://bugzilla.suse.com/1075026 SUSE Bug 1075026 In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file. CVE-2018-5296 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2018-5296.html CVE-2018-5296 https://bugzilla.suse.com/1075021 SUSE Bug 1075021 PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file. CVE-2018-5308 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2018-5308.html CVE-2018-5308 https://bugzilla.suse.com/1075772 SUSE Bug 1075772 In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file. CVE-2018-5309 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2018-5309.html CVE-2018-5309 https://bugzilla.suse.com/1075322 SUSE Bug 1075322 In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. CVE-2018-5783 SUSE Linux Enterprise Desktop 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Desktop 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP3:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Software Development Kit 12 SP4:libpodofo-devel-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP3:libpodofo0_9_2-0.9.2-3.6.3 SUSE Linux Enterprise Workstation Extension 12 SP4:libpodofo0_9_2-0.9.2-3.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/ https://www.suse.com/security/cve/CVE-2018-5783.html CVE-2018-5783 https://bugzilla.suse.com/1076962 SUSE Bug 1076962