CVE-2017-5852

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-5852

CWE

https://cwe.mitre.org/data/definitions/835.html

The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted file.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name	Vendor	Start Version	End Version
Podofo	Podofo_project	0.9.4 (including)	0.9.4 (including)
Libpodofo	Ubuntu	artful	*
Libpodofo	Ubuntu	esm-apps/xenial	*
Libpodofo	Ubuntu	precise	*
Libpodofo	Ubuntu	trusty	*
Libpodofo	Ubuntu	trusty/esm	*
Libpodofo	Ubuntu	upstream	*
Libpodofo	Ubuntu	xenial	*
Libpodofo	Ubuntu	yakkety	*
Libpodofo	Ubuntu	zesty	*

References

http://www.openwall.com/lists/oss-security/2017/02/01/12
http://www.openwall.com/lists/oss-security/2017/02/02/10
http://www.securityfocus.com/bid/97032
https://blogs.gentoo.org/ago/2017/02/01/podofo-infinite-loop-in-podofopdfpagegetinheritedkeyfromobject-pdfpage-cpp/

Loop with Unreachable Exit Condition ('Infinite Loop')

Weakness

Affected Software

References