NVD Vulnerability Detail

CVE-2019-9199

Summary	PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Publication Date	Feb. 27, 2019, 8:29 a.m.
Registration Date	Jan. 26, 2021, 11:45 a.m.
Last Update	Nov. 21, 2024, 1:51 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:podofo_project:podofo:0.9.6:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/jjanku/podofo/commit/ada821df68fb0bf673840ed525daf4ec709dbfd9
2	https://github.com/mksdev/podofo/commit/1400a9aaf611299b9a56aa2abeb158918b9743c8
3	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIC2EXSSMBT3MY2HY42IIY4BUQS2SVYB/
4	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTJ5AAM6Y4NMSELEH7N5ZG4DNO56BCYF/
5	https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-setsource-podofo-0-9-6-trunk-r1967/	Exploit Third Party Advisory
6	https://sourceforge.net/p/podofo/tickets/40/	Exploit Third Party Advisory
7	https://github.com/jjanku/podofo/commit/ada821df68fb0bf673840ed525daf4ec709dbfd9
8	https://sourceforge.net/p/podofo/tickets/40/	Exploit Third Party Advisory
9	https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-setsource-podofo-0-9-6-trunk-r1967/	Exploit Third Party Advisory
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTJ5AAM6Y4NMSELEH7N5ZG4DNO56BCYF/
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIC2EXSSMBT3MY2HY42IIY4BUQS2SVYB/
12	https://github.com/mksdev/podofo/commit/1400a9aaf611299b9a56aa2abeb158918b9743c8

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-476	NULL ポインタデリファレンス	https://cwe.mitre.org/data/definitions/476.html

JVN Vulnerability Information

PoDoFo における NULL ポインタデリファレンスに関する脆弱性

Title	PoDoFo における NULL ポインタデリファレンスに関する脆弱性
Summary	PoDoFo には、NULL ポインタデリファレンスに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 25, 2019, midnight
Registration Date	April 2, 2019, 3 p.m.
Last Update	April 2, 2019, 3 p.m.

Affected System

PoDoFo project

PoDoFo 0.9.6

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-9199	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9199
2	CVE-2019-9199	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9199
National Vulnerability Database (NVD)
3	CVE-2019-9199	https://nvd.nist.gov/vuln/detail/CVE-2019-9199
4	CVE-2019-9199	https://nvd.nist.gov/vuln/detail/CVE-2019-9199

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-476	http://cwe.mitre.org/data/definitions/476.html
2	CWE-476	http://cwe.mitre.org/data/definitions/476.html

ベンダー情報

No	Name	URL
SourceForge
1	#40 Null pointer dereference vulnerability in PoDoFo::Impose::PdfTranslator::setSource()	https://sourceforge.net/p/podofo/tickets/40/
2	#40 Null pointer dereference vulnerability in PoDoFo::Impose::PdfTranslator::setSource()	https://sourceforge.net/p/podofo/tickets/40/

Change Log

No	Changed Details	Date of change
1	[2019年04月02日] 掲載	April 2, 2019, 3 p.m.