CVE-2018-11797: Medium severity Apache PDFBox vulnerability
A vulnerability related to parsing was found in Apache PDFBox parser. A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
External References:
https://lists.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361d91006b663a0a418d34a@%3Cannounce.apache.org%3E
Other sources
Apache PDFBox is vulnerable to a denial of service, caused by a flaw when parsing the page tree. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-11797?
CVE-2018-11797 is a vulnerability in Apache PDFBox that allows a remote attacker to cause a denial of service by exploiting a flaw when parsing the page tree in a specially-crafted PDF file.
How can I exploit CVE-2018-11797?
As a cybersecurity analyst, I cannot provide information on how to exploit vulnerabilities. It is important to focus on applying the necessary patches and security updates to protect against this vulnerability.
What is the severity of CVE-2018-11797?
CVE-2018-11797 has a severity rating of 5.5, which is classified as medium severity.
How do I mitigate CVE-2018-11797?
To mitigate CVE-2018-11797, ensure that you have updated to Apache PDFBox version 1.8.16 or 2.0.12, depending on the affected version you are using.
Where can I find more information about CVE-2018-11797?
You can find more information about CVE-2018-11797 on the Apache PDFBox mailing list and the bug report provided by Red Hat in the references section.