CVE-2019-10723: Medium severity Podofo Project Podofo vulnerability
An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libpodofoto a version that resolves this vulnerability.Fixed in 0.9.8+dfsg-3Fixed in 0.9.8+dfsg-3.2 - Upgrade
Upgrade
alpine/podofoto a version that resolves this vulnerability.Fixed in 0.9.7-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10723?
CVE-2019-10723 has a moderate severity rating due to its potential for excessive memory allocation.
How do I fix CVE-2019-10723?
To fix CVE-2019-10723, upgrade to PoDoFo version 0.9.8 or later.
What causes the CVE-2019-10723 vulnerability?
The vulnerability in CVE-2019-10723 is caused by insufficient validation of the initial size parameter in memory allocation.
Which versions of PoDoFo are affected by CVE-2019-10723?
CVE-2019-10723 affects PoDoFo versions up to and including 0.9.6.
Is CVE-2019-10723 present in Debian packages?
Yes, CVE-2019-10723 is present in Debian packages of libpodofo before version 0.9.8+dfsg-3.