GitHub Advisoryadvisory · Maven

GHSA-gx96-vgf7-hwfg In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation

MEDIUM Published 2018-10-17 Modified 2022-04-27 Official page ↗
Aliases
CVE-2018-11797
Ecosystem
Maven
Packages
org.apache.pdfbox:pdfbox
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• Maven org.apache.pdfbox:pdfbox: >= 1.8.0, < 1.8.16 → fixed in 1.8.16 • Maven org.apache.pdfbox:pdfbox: >= 2.0.0, < 2.0.12 → fixed in 2.0.12

Description

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Related

Alias · CVE (1)

  • CVE-2018-11797 In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References