https://bugzilla.redhat.com/show_bug.cgi?id=1597490
Bug ID: 1597490
Summary: CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java
allows for out of memory erros via crafted PDF
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lpetrovi(a)redhat.com, meissner(a)suse.de,
nwallace(a)redhat.com, orion(a)nwra.com,
paradhya(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, vhalbert(a)redhat.com
PDFBox before versions 1.8.15 and 2.0.11 has an infinitre loop in
AFMParser.java. An attacker could exploit this to cause an out of memory error
via a crafted PDF.
External Reference:
http://www.openwall.com/lists/oss-security/2018/06/29/1
Upstream Release Notes:
https://www.apache.org/dist/pdfbox/2.0.11/RELEASE-NOTES.txt
https://www.apache.org/dist/pdfbox/1.8.15/RELEASE-NOTES.txt
Upstream Issue:
https://issues.apache.org/jira/projects/PDFBOX/issues/PDFBOX-4251
Upstream Patches:
http://svn.apache.org/viewvc/pdfbox/trunk/fontbox/src/main/java/org/apach...
http://svn.apache.org/viewvc/pdfbox/branches/2.0/fontbox/src/main/java/or...
http://svn.apache.org/viewvc/pdfbox/branches/1.8/fontbox/src/main/java/or...
--
You are receiving this mail because:
You are on the CC list for the bug.