CVE-2017-5854

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2017/02/01/14Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/02/12Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/96072
https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-pdfoutputstream-cpp/Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2017/02/01/14Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/02/12Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/96072
https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-pdfoutputstream-cpp/Third Party Advisory, VDB Entry

Timeline

Published: Mar 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-58555.5The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NU CVE-2017-58566.5Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to CVE-2017-58576.5Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users CVE-2017-58585.9An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ CVE-2017-58599.8On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, CVE-2017-58639.8Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.CVE-2017-58646.1Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-58653.7The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends diff CVE-2017-58664.3The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x befo CVE-2017-58676.5ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a d CVE-2017-58686.1CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers an CVE-2017-58698.8Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to u