In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Update to 2.0.16

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for apache-pdfbox fixes the following issues :

Security issue fixed :

  - CVE-2018-8036: Fix infinite loop while parsing files     that leads to an out of memory issue (bsc#1099721).

This update was imported from the SUSE:SLE-15:Update update project.

This update for apache-pdfbox fixes the following security issue :

  - CVE-2018-8036: A crafted file could have triggered an     infinite loop which lead to DoS (bsc#1099721).

  - CVE-2018-11797: A carefully crafted PDF file can trigger     an extremely long running computation when parsing the     page tree. (bsc#1111009) :

This update was imported from the SUSE:SLE-12-SP3:Update update project.

ID	Name	Product	Family	Severity
129630	Fedora 31 : pdfbox (2019-88f53a7433)	Nessus	Fedora Local Security Checks	critical
128625	Fedora 30 : pdfbox (2019-9e91afa2be)	Nessus	Fedora Local Security Checks	critical
128624	Fedora 29 : pdfbox (2019-6fa01d12b4)	Nessus	Fedora Local Security Checks	critical
123290	openSUSE Security Update : apache-pdfbox (openSUSE-2019-670)	Nessus	SuSE Local Security Checks	medium
118381	openSUSE Security Update : apache-pdfbox (openSUSE-2018-1245)	Nessus	SuSE Local Security Checks	medium
117353	openSUSE Security Update : apache-pdfbox (openSUSE-2018-975)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-8036

medium

Tenable Plugins

critical

critical

critical

medium

medium

medium