SUSE-SU-2019:0393-1

Dashboard / Vulnerabilities / SUSE-SU-2019:0393-1

SUSE-SU-2019:0393-1

Summary: Security update for podofo

Details: This update for podofo fixes the following issues: These security issues were fixed: - CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1027779). - CVE-2018-5308: Properly validate memcpy arguments in the PdfMemoryOutputStream::Write function to prevent remote attackers from causing a denial-of-service or possibly have unspecified other impact via a crafted pdf file (bsc#1075772) - CVE-2018-5295: Prevent integer overflow in the PdfXRefStreamParserObject::ParseStream function that allowed remote attackers to cause a denial-of-service via a crafted pdf file (bsc#1075026). - CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1027779). - CVE-2018-5309: Prevent integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function that allowed remote attackers to cause a denial-of-service via a crafted pdf file (bsc#1075322). - CVE-2018-5296: Prevent uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function that allowed remote attackers to cause a denial-of-service via a crafted pdf file (bsc#1075021). - CVE-2017-7381: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1032020). - CVE-2017-7382: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1032021). - CVE-2017-7383: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1032022). - CVE-2018-11256: Prevent NULL pointer dereference that allowed remote attackers to cause a denial of service via a crafted PDF document (bsc#1096889). - CVE-2018-5783: Prevent uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function that allowed remote attackers to cause a denial of service via a crafted pdf file (bsc#1076962). These non-security issues were fixed: - Prevent regression caused by the fix for CVE-2017-8054. - Prevent NULL dereferences when 'Kids' array is missing (bsc#1096890) - Added to detect cycles and recursions in XRef tables

References: https://www.suse.com/support/update/announcement/2019/suse-su-20190393-1/, https://bugzilla.suse.com/1027779, https://bugzilla.suse.com/1032020, https://bugzilla.suse.com/1032021, https://bugzilla.suse.com/1032022, https://bugzilla.suse.com/1075021, https://bugzilla.suse.com/1075026, https://bugzilla.suse.com/1075322, https://bugzilla.suse.com/1075772, https://bugzilla.suse.com/1076962, https://bugzilla.suse.com/1096889, https://bugzilla.suse.com/1096890, https://www.suse.com/security/cve/CVE-2017-6845, https://www.suse.com/security/cve/CVE-2017-7381, https://www.suse.com/security/cve/CVE-2017-7382, https://www.suse.com/security/cve/CVE-2017-7383, https://www.suse.com/security/cve/CVE-2017-8054, https://www.suse.com/security/cve/CVE-2018-11256, https://www.suse.com/security/cve/CVE-2018-5295, https://www.suse.com/security/cve/CVE-2018-5296, https://www.suse.com/security/cve/CVE-2018-5308, https://www.suse.com/security/cve/CVE-2018-5309, https://www.suse.com/security/cve/CVE-2018-5783