CVE-2019-9199

NameCVE-2019-9199
DescriptionPoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs923469

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libpodofo (PTS)stretch0.9.4-6vulnerable
bullseye, sid, buster0.9.6+dfsg-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libpodofosource(unstable)0.9.6+dfsg-5low923469

Notes

[stretch] - libpodofo <no-dsa> (Minor issue)
[jessie] - libpodofo <no-dsa> (Minor issue)
https://sourceforge.net/p/podofo/tickets/40/
upstream fix: https://sourceforge.net/p/podofo/code/1971/
Search for package or bug name: Reporting problems