GHSA-j2xq-pfff-mvgg

Suggest an improvement
Source
https://github.com/advisories/GHSA-j2xq-pfff-mvgg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j2xq-pfff-mvgg/GHSA-j2xq-pfff-mvgg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j2xq-pfff-mvgg
Aliases
Published
2022-05-13T01:53:29Z
Modified
2024-02-20T05:34:40.059516Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Loop with Unreachable Exit Condition in Apache PDFBox
Details

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Database specific 
{
    "nvd_published_at": "2018-07-03T20:29:00Z",
    "cwe_ids": [
        "CWE-835"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-29T18:54:14Z"
}
References

Affected packages

Maven / org.apache.pdfbox:pdfbox

Package

Name
org.apache.pdfbox:pdfbox
View open source insights on deps.dev
Purl
pkg:maven/org.apache.pdfbox/pdfbox

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.8.0
Fixed
1.8.15

Affected versions

1.*

1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8.10
1.8.11
1.8.12
1.8.13
1.8.14

Database specific 

{
    "last_known_affected_version_range": "<= 1.8.14"
}

Maven / org.apache.pdfbox:pdfbox

Package

Name
org.apache.pdfbox:pdfbox
View open source insights on deps.dev
Purl
pkg:maven/org.apache.pdfbox/pdfbox

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0RC1
Fixed
2.0.11

Affected versions

2.*

2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10

Database specific 

{
    "last_known_affected_version_range": "<= 2.0.10"
}