Bug 617204 – <app-text/podofo-0.9.6_pre20170508-r1: Denial of Service

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2017-05-01 15:42:47 UTC]

CVE-2017-8378 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8378):
  Heap-based buffer overflow in the PdfParser::ReadObjects function in
  base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial
  of service (application crash) or possibly have unspecified other impact via
  vectors related to m_offsets.size.

[Comment 1 Yury German 2017-05-01 15:44:14 UTC]

Maintainer(s) please advise if this affects any version prior to 0.9.5.

[Comment 2 Zac Medico 2017-05-01 16:50:43 UTC]

(In reply to Yury German from comment #1)
> Maintainer(s) please advise if this affects any version prior to 0.9.5.

The vulnerable "m_offsets[i].bParsed = false;" code in the PdfParser::ReadObjects method appears to be present in all versions going back to the oldest one in the tree, 0.9.2. There's a fix r1833, but no tag yet:

https://sourceforge.net/p/podofo/code/1833/tree//podofo/trunk/src/base/PdfParser.cpp?diff=50f1cef7e88f3d7cbdd252d0:1832

I'll go ahead and create a snapshot from trunk.

[Comment 3 Zac Medico 2017-05-01 17:12:37 UTC]

Added podofo-0.9.6_pre20170428 ebuild to gentoo:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5685a989182a75db3a35172af432e43468cf42bc

[Comment 4 Yury German 2017-05-01 17:17:29 UTC]

Would this fix also apply to Bug 614038?
https://bugs.gentoo.org/show_bug.cgi?id=614038

[Comment 5 Agostino Sarubbo 2017-05-01 20:27:50 UTC]

(In reply to Yury German from comment #4)
> Would this fix also apply to Bug 614038?
> https://bugs.gentoo.org/show_bug.cgi?id=614038

It doesn't. I stopped the fuzz research on podof because there was ~30 bugs and no upstream reaction. From svn I see that ~4/5 bugs were fixed.

[Comment 6 Zac Medico 2017-05-10 20:38:19 UTC]

Bumped to 0.9.6_pre20170508:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=213746d55265ff9167fbf4aa616b840775c4258d

Fixes since 0.9.6_pre20170428:

------------------------------------------------------------------------
r1849 | aja_ | 2017-05-08 10:00:13 -0700 (Mon, 08 May 2017) | 2 lines

Fix CVE-2017-7994: NULL dereference in TextExtractor::ExtractText()

------------------------------------------------------------------------
r1848 | aja_ | 2017-05-08 07:21:17 -0700 (Mon, 08 May 2017) | 2 lines

Fix CVE-2017-7380: NULL dereference in PdfPage::GetFromResources()

------------------------------------------------------------------------
r1847 | aja_ | 2017-05-08 07:15:41 -0700 (Mon, 08 May 2017) | 2 lines

Fix CVE-2017-7378: Out of bounds read in PdfPainter::ExpandTabs()

------------------------------------------------------------------------
r1846 | aja_ | 2017-05-08 06:54:34 -0700 (Mon, 08 May 2017) | 2 lines

Fix CVE-2017-6847: NULL pointer dereference when reading XObject without BBox

------------------------------------------------------------------------
r1845 | aja_ | 2017-05-08 06:33:17 -0700 (Mon, 08 May 2017) | 2 lines

Correct fix for CVE-2017-6840: Too strict check for given arguments.

------------------------------------------------------------------------
r1844 | aja_ | 2017-05-08 06:23:49 -0700 (Mon, 08 May 2017) | 2 lines

Fix CVE-2017-6840: Out of bounds read in ColorChanger::GetColorFromStack()

------------------------------------------------------------------------
r1843 | aja_ | 2017-05-08 06:05:38 -0700 (Mon, 08 May 2017) | 5 lines

Fix CVE-2017-5855: NULL pointer dereference in PoDoFo::PdfParser::ReadXRefSubsection

Throw PoDoFo's Out of memory exception when resize of std::vector fails
when reading XRef content.

------------------------------------------------------------------------

[Comment 7 Yury German 2017-05-11 05:25:17 UTC]

Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.

[Comment 8 Zac Medico 2017-05-12 10:30:54 UTC]

I've revbumped it to podofo-0.9.6_pre20170508-r1 with a customized libpodofo.so.0.9.6_pre20170508 soname, since the libpodofo.so.0.9.6 ABI is not necessarily stable yet.

We should let this get tested for a couple of days before we call for stabilization.

[Comment 9 Zac Medico 2017-05-15 08:43:20 UTC]

Please stabilize.

[Comment 10 Agostino Sarubbo 2017-05-15 14:18:05 UTC]

amd64 stable

[Comment 11 Jeroen Roovers (RETIRED) 2017-05-16 05:00:00 UTC]

Stable for HPPA.

[Comment 12 Agostino Sarubbo 2017-05-16 08:01:28 UTC]

x86 stable

[Comment 13 Agostino Sarubbo 2017-05-16 13:06:52 UTC]

ppc64 stable

[Comment 14 Michael Weber (RETIRED) 2017-05-18 05:01:12 UTC]

ppc stable, all arches done.

[Comment 15 Yury German 2017-05-18 05:09:15 UTC]

Arches and Maintainer(s), Thank you for your work.
GLSA Vote: No

Maintainer(s), please drop the vulnerable version(s).

[Comment 16 Zac Medico 2017-05-18 06:52:25 UTC]

Dropped vulnerable versions:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a5245004eda3b53d1adc39cbe56a5096600d198b

[Comment 17 Yury German 2017-05-18 06:54:05 UTC]

Arches and Maintainer(s), Thank you for your work.
Closing noglsa.