An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an     attempted excessive memory allocation because nInitialSize is not validated. (CVE-2019-10723)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7217-1 advisory.

    It was discovered that the PoDoFo library could dereference a NULL pointer when getting the number of     pages in a PDF. If a user or application were tricked into opening a crafted PDF file, an attacker could     possibly use this issue to cause a denial of service. This issue only affected

    Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2018-11255)

    It was discovered that PoDoFo library incorrectly handled memory when computing an encryption key, which     could lead to a buffer overflow. If a user or application were tricked into opening a crafted PDF file, an     attacker could possibly use this issue to cause a denial of service. (CVE-2018-12983)

    It was discovered that the PoDoFo library incorrectly handled memory allocation. If a user or application     were tricked into opening a crafted PDF file, an attacker could possibly use this issue to cause a denial     of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2018-20797)

    It was discovered that the PoDoFo library did not properly validate memcpy arguments. If a user or     application were tricked into opening a crafted PDF file, an attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu     16.04 LTS. (CVE-2018-5308)

    It was discovered that the PoDoFo library incorrectly handled memory in the GetNextToken function, which     could lead to a buffer overflow. If a user or application were tricked into opening a crafted PDF file, an     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     LTS. (CVE-2017-5886)

    It was discovered that the PoDoFo library could enter an infinite loop, which could lead to a stack     overflow. If a user or application were tricked into opening a crafted PDF file, an attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2018-8002, CVE-2020-18971, CVE-2021-30471, CVE-2021-30470)

    It was discovered that the PoDoFo library incorrectly handled memory allocation due to nInitialSize not     being validated. If a user or application were tricked into opening a crafted PDF file, an attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-10723)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3541-1 advisory.

    - CVE-2015-8981: Fixed heap overflow in the function ReadXRefSubsection (bsc#1023190)
     - CVE-2017-6840: Fixed invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp)     (bsc#1027787)
     - CVE-2017-6841: Fixed NULL pointer dereference in     GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h) (bsc#1027786)
     - CVE-2017-6842: Fixed NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp)     (bsc#1027785)
     - CVE-2017-6845: Fixed NULL pointer dereference in     GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h) (bsc#1027779)
     - CVE-2017-6849: Fixed NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp)     (bsc#1027776)
     - CVE-2017-8378: Fixed denial of service (application crash) vectors related to m_offsets.size     (PdfParser::ReadObjects func in base/PdfParser.cpp) (bsc#1037000)
     - CVE-2018-5308: Fixed Undefined behavior  (memcpy with NULL pointer) in PdfMemoryOutputStream::Write     (src/base/PdfOutputStream.cpp) (bsc#1075772)
     - CVE-2019-10723: Fixed Memory leak in PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp (bsc#1131544)
     - CVE-2019-9199: Fixed NULL pointer dereference in function PoDoFo:Impose:PdfTranslator:setSource() in     pdftranslator.cpp (bsc#1127855)

     - Fixed NULL pointer dereference in PdfInfo::GuessFormat (pdfinfo.cpp) (bsc#1023072)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2137-1 advisory.

    - CVE-2019-9199: Fixed a NULL pointer dereference in podofoimpose (bsc#1127855)
    - CVE-2018-20797: Fixed an excessive memory allocation in PoDoFo:podofo_calloc (bsc#1127514)
    - CVE-2019-10723: Fixed a memory leak in PdfPagesTreeCache (bsc#1131544)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
222545	Linux Distros Unpatched Vulnerability : CVE-2019-10723	Nessus	Misc.	medium
214391	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : PoDoFo library vulnerabilities (USN-7217-1)	Nessus	Ubuntu Local Security Checks	high
208427	SUSE SLED12 / SLES12 Security Update : podofo (SUSE-SU-2024:3541-1)	Nessus	SuSE Local Security Checks	critical
200847	SUSE SLES15 / openSUSE 15 Security Update : podofo (SUSE-SU-2024:2137-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-10723

medium

Tenable Plugins

medium

high

critical

high