CVE-2023-24808
First published: Tue Feb 07 2023(Updated: )
PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pdfio Project Pdfio | <1.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-24808?
CVE-2023-24808 is a denial of service (DOS) vulnerability in the pdfio parser of PDFio, a C library for reading and writing PDF files.
What is the severity of CVE-2023-24808?
The severity of CVE-2023-24808 is medium, with a CVSS score of 6.5.
How does CVE-2023-24808 affect the software?
CVE-2023-24808 affects PDFio versions prior to 1.1.0.
How can CVE-2023-24808 be exploited?
Crafted PDF files can cause the program to run at 100% utilization and never terminate, resulting in a denial of service.
Is there a fix available for CVE-2023-24808?
Yes, a fix for CVE-2023-24808 is available in version 1.1.0 of PDFio.
- collector/nvd-index
- vendor/pdfio project
- canonical/pdfio project pdfio