Vulnerability Description
The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Podofo Project | Podofo | 0.9.6 |
| Fedoraproject | Fedora | 30 |
Related Weaknesses (CWE)
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://sourceforge.net/p/podofo/tickets/75/ExploitIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://sourceforge.net/p/podofo/tickets/75/ExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2019-20093?
CVE-2019-20093 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtract...
How severe is CVE-2019-20093?
CVE-2019-20093 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-20093?
Check the references section above for vendor advisories and patch information. Affected products include: Podofo Project Podofo, Fedoraproject Fedora.