CVE-2018-19532

Name	CVE-2018-19532
Description	A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)
Debian Bugs	916085

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpodofo (PTS)	jessie	0.9.0-1.2	vulnerable
	stretch	0.9.4-6	vulnerable
	buster, sid	0.9.6+dfsg-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libpodofo	source	(unstable)	0.9.6+dfsg-4	low		916085

Notes

[stretch] - libpodofo <no-dsa> (Minor issue)
[jessie] - libpodofo <no-dsa> (Minor issue)
https://sourceforge.net/p/podofo/tickets/32/
https://sourceforge.net/p/podofo/code/1950/