CVE-2019-9199: Null Pointer Dereference
PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/podofoto a version that resolves this vulnerability.Fixed in 0.9.7-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9199?
CVE-2019-9199 is classified as a Denial of Service vulnerability due to a NULL pointer dereference.
How do I fix CVE-2019-9199?
To remediate CVE-2019-9199, upgrade PoDoFo to version 0.9.6 or later.
What software is affected by CVE-2019-9199?
CVE-2019-9199 affects the PoDoFo version 0.9.6 and Fedora versions 29 and 30.
What type of attack does CVE-2019-9199 allow?
CVE-2019-9199 allows attackers to cause a Denial of Service, potentially leading to a segmentation fault.
Where in the code does CVE-2019-9199 occur?
CVE-2019-9199 occurs in the setSource() function of pdftranslator.cpp in PoDoFo.