libpodofo: CVE-2018-12983

Debian Bug report logs - #916580
libpodofo: CVE-2018-12983

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libpodofo: CVE-2018-12983

Date: Sun, 16 Dec 2018 10:53:26 +0100

Source: libpodofo
Version: 0.9.6+dfsg-3
Severity: important
Tags: security upstream
Forwarded: https://sourceforge.net/p/podofo/tickets/23

Hi,

The following vulnerability was published for libpodofo.

CVE-2018-12983[0]:
| A stack-based buffer over-read in the
| PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in
| PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a
| denial-of-service via a crafted pdf file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-12983
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12983
[1] https://sourceforge.net/p/podofo/tickets/23

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 916580@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 916580@bugs.debian.org

Subject: Re: libpodofo: CVE-2018-12983

Date: Sun, 17 Mar 2019 20:36:50 +0100

On Sun, Dec 16, 2018 at 10:53:26AM +0100, Salvatore Bonaccorso wrote:
> Source: libpodofo
> Version: 0.9.6+dfsg-3
> Severity: important
> Tags: security upstream
> Forwarded: https://sourceforge.net/p/podofo/tickets/23
> 
> Hi,
> 
> The following vulnerability was published for libpodofo.
> 
> CVE-2018-12983[0]:
> | A stack-based buffer over-read in the
> | PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in
> | PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a
> | denial-of-service via a crafted pdf file.

> [1] https://sourceforge.net/p/podofo/tickets/23

The ticket has a proposed patch, could you ping upstream to review/merge it?

Cheers,
        Moritz

Message #13 received at 916580@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 916580@bugs.debian.org

Subject: Re: Bug#916580: libpodofo: CVE-2018-12983

Date: Sun, 17 Mar 2019 22:05:47 +0100

[Message part 1 (text/plain, inline)]

On Sun, Mar 17, 2019 at 08:36:50PM +0100, Moritz Mühlenhoff wrote:
> > [1] https://sourceforge.net/p/podofo/tickets/23
> 
> The ticket has a proposed patch, could you ping upstream to review/merge it?

No, because the one who proposed that patch (Matthew Brincke) _is_
upstream, and he is asking for an external review because he doesn't
trust himself with it.

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.