CVE-2017-7994: Null Pointer Dereference

Published Apr 21, 2017

Updated

The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.

Affected Software

2 affected componentsFixes available

debian/libpodofo

0.9.7+dfsg-20.9.8+dfsg-30.9.8+dfsg-3.1

Podofo Project Podofo=0.9.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libpodofo to a version that resolves this vulnerability.
Fixed in 0.9.7+dfsg-2Fixed in 0.9.8+dfsg-3Fixed in 0.9.8+dfsg-3.1

Event History

Apr 21, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-7994?

CVE-2017-7994 has a medium severity rating due to its potential to cause a denial of service.

How do I fix CVE-2017-7994?

To fix CVE-2017-7994, upgrade PoDoFo to version 0.9.7 or higher.

What is the impact of CVE-2017-7994?

The impact of CVE-2017-7994 is that it allows remote attackers to crash the application by exploiting a NULL pointer dereference.

Which versions of PoDoFo are affected by CVE-2017-7994?

PoDoFo version 0.9.5 is specifically affected by CVE-2017-7994.

Is CVE-2017-7994 being actively exploited?

There is no public information indicating active exploitation of CVE-2017-7994, but it remains a potential risk.