Bug 1096890 - (CVE-2018-11255) VUL-1: CVE-2018-11255: podofo: Null Pointer Dereference Denial of Service in PdfPage::GetPageNumber()
(CVE-2018-11255)
VUL-1: CVE-2018-11255: podofo: Null Pointer Dereference Denial of Service in ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/206165/
CVSSv3:RedHat:CVE-2018-11255:3.3:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-06-11 08:34 UTC by Marcus Meissner
Modified: 2019-10-31 08:21 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
crash2.pdf (2.63 KB, application/pdf)
2018-06-11 08:36 UTC, Marcus Meissner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-06-11 08:34:13 UTC
rh#1575502

An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber()
in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of
service (NULL pointer dereference and application crash) via a crafted PDF
document.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1575502
https://bugzilla.redhat.com/show_bug.cgi?id=1581282
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11255
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-11255.html
http://www.cvedetails.com/cve/CVE-2018-11255/
Comment 1 Marcus Meissner 2018-06-11 08:36:10 UTC
Created attachment 773392 [details]
crash2.pdf

QA REPRODUCER:

podofopdfinfo crash2.pdf

should not crash
Comment 2 Antonio Larrosa 2018-06-26 16:34:09 UTC
On SLE12 the crash given by the attached reproducer document happens in a different location than in PoDoFo 0.9.5, as given in the CVE information. In fact, the crash is fixed in SLE12 by r1836-Fix-for-CVE-2017-5854.patch, included in isr 167536 .
Comment 3 Antonio Larrosa 2018-09-19 13:23:28 UTC
Submitted https://build.suse.de/request/show/172442 to fix this for SLE-12 with the same patch than upstream
Comment 4 Swamp Workflow Management 2019-02-14 17:11:02 UTC
SUSE-SU-2019:0393-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1027779,1032020,1032021,1032022,1075021,1075026,1075322,1075772,1076962,1096889,1096890
CVE References: CVE-2017-6845,CVE-2017-7381,CVE-2017-7382,CVE-2017-7383,CVE-2017-8054,CVE-2018-11256,CVE-2018-5295,CVE-2018-5296,CVE-2018-5308,CVE-2018-5309,CVE-2018-5783
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    podofo-0.9.2-3.6.3
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    podofo-0.9.2-3.6.3
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    podofo-0.9.2-3.6.3
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    podofo-0.9.2-3.6.3
SUSE Linux Enterprise Desktop 12-SP4 (src):    podofo-0.9.2-3.6.3
SUSE Linux Enterprise Desktop 12-SP3 (src):    podofo-0.9.2-3.6.3
Comment 6 Swamp Workflow Management 2019-07-15 16:15:08 UTC
SUSE-SU-2019:1849-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1035596,1076962,1096890,1099720,1124357
CVE References: CVE-2017-8054,CVE-2018-11255,CVE-2018-12982,CVE-2018-20751,CVE-2018-5783
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    podofo-0.9.2-3.9.2
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    podofo-0.9.2-3.9.2
SUSE Linux Enterprise Desktop 12-SP4 (src):    podofo-0.9.2-3.9.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Marcus Meissner 2019-10-31 08:21:44 UTC
released