Fluid Attacks Database

Description

Loop with Unreachable Exit Condition in Apache PDFBox In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.pdfbox:pdfbox	>=1.8.0 <1.8.15 \|\| >=2.0.0rc1 <2.0.11	1.8.15, 2.0.11
debian 12	libpdfbox2-java	>=0 <2.0.11-1	2.0.11-1
debian 13	libpdfbox2-java	>=0 <2.0.11-1	2.0.11-1
debian 11	libpdfbox-java	>=0 <1:1.8.15-1	1:1.8.15-1
debian 12	libpdfbox-java	>=0 <1:1.8.15-1	1:1.8.15-1
debian 14	libpdfbox2-java	>=0 <2.0.11-1	2.0.11-1
debian 14	libpdfbox-java	>=0 <1:1.8.15-1	1:1.8.15-1
debian 13	libpdfbox-java	>=0 <1:1.8.15-1	1:1.8.15-1
debian 11	libpdfbox2-java	>=0 <2.0.11-1	2.0.11-1

Aliases

1. CVE-2018-80362. NVD-2018-80363. OSV-2018-80364. OSV-DEBIAN-2018-80365. GCVE-2018-80366. access.redhat.com7. SECURITY-TRACKER-CVE-2018-8036

References

1. https://lists.apache.org/thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6@%3Cusers.pdfbox.apache.org%3E2. https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540@%3Cdev.syncope.apache.org%3E3. https://lists.fedoraproject.org/archives/list/[email protected]/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ4. https://lists.fedoraproject.org/archives/list/[email protected]/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX5. https://www.oracle.com/security-alerts/cpuapr2020.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.