CVE-2023-24808

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-24808
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24808.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-24808
Related
Published
2023-02-07T01:15:09Z
Modified
2025-01-15T04:44:10.559850Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

Affected packages

Debian:12 / ippsample

Package

Name
ippsample
Purl
pkg:deb/debian/ippsample?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.0~git20220607.72f89b3-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/michaelrsweet/pdfio

Affected ranges

Type
GIT
Repo
https://github.com/michaelrsweet/pdfio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v1.*

v1.0.0
v1.0.1
v1.0b1
v1.0b2