CVE-2023-24808

Katalog CVE

CVSS 6.5 · Medium EPSS 0,72%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada pdfio project pdfio. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

7 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/michaelrsweet/pdfio/commit/4f10021e7ee527c1aa24853e2947e38e154d9ccb patch · advisory pihak ketiga
• https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-cjc4-x96x-fvgf exploit · advisory pihak ketiga