GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2024:3541-1

Vulnerability from csaf_suse - Published: 2024-10-08 08:33 - Updated: 2024-10-08 08:33
Summary
Security update for podofo
Severity
Moderate
Notes
Title of the patch: Security update for podofo
Description of the patch: This update for podofo fixes the following issues: - CVE-2015-8981: Fixed heap overflow in the function ReadXRefSubsection (bsc#1023190) - CVE-2017-6840: Fixed invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027787) - CVE-2017-6841: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h) (bsc#1027786) - CVE-2017-6842: Fixed NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027785) - CVE-2017-6845: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h) (bsc#1027779) - CVE-2017-6849: Fixed NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp) (bsc#1027776) - CVE-2017-8378: Fixed denial of service (application crash) vectors related to m_offsets.size (PdfParser::ReadObjects func in base/PdfParser.cpp) (bsc#1037000) - CVE-2018-5308: Fixed Undefined behavior (memcpy with NULL pointer) in PdfMemoryOutputStream::Write (src/base/PdfOutputStream.cpp) (bsc#1075772) - CVE-2019-10723: Fixed Memory leak in PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp (bsc#1131544) - CVE-2019-9199: Fixed NULL pointer dereference in function PoDoFo:Impose:PdfTranslator:setSource() in pdftranslator.cpp (bsc#1127855) - Fixed NULL pointer dereference in PdfInfo::GuessFormat (pdfinfo.cpp) (bsc#1023072)
Patchnames: SUSE-2024-3541,SUSE-SLE-SDK-12-SP5-2024-3541,SUSE-SLE-WE-12-SP5-2024-3541
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2015-8981
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2017-5854
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2017-6840
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2017-6841
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2017-6842
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2017-6845
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2017-6849
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2017-8378
5.9 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2018-5308
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2019-10723
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact moderate
CVE-2019-9199
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 5 products, the same list as for CVE-2015-8981
Threats
Impact low
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/s… self
https://www.suse.com/support/update/announcement/… self
https://lists.suse.com/pipermail/sle-security-upd… self
https://bugzilla.suse.com/1023072 self
https://bugzilla.suse.com/1023190 self
https://bugzilla.suse.com/1027776 self
https://bugzilla.suse.com/1027779 self
https://bugzilla.suse.com/1027785 self
https://bugzilla.suse.com/1027786 self
https://bugzilla.suse.com/1027787 self
https://bugzilla.suse.com/1037000 self
https://bugzilla.suse.com/1075772 self
https://bugzilla.suse.com/1127855 self
https://bugzilla.suse.com/1131544 self
https://www.suse.com/security/cve/CVE-2015-8981/ self
https://www.suse.com/security/cve/CVE-2017-5854/ self
https://www.suse.com/security/cve/CVE-2017-6840/ self
https://www.suse.com/security/cve/CVE-2017-6841/ self
https://www.suse.com/security/cve/CVE-2017-6842/ self
https://www.suse.com/security/cve/CVE-2017-6845/ self
https://www.suse.com/security/cve/CVE-2017-6849/ self
https://www.suse.com/security/cve/CVE-2017-8378/ self
https://www.suse.com/security/cve/CVE-2018-5308/ self
https://www.suse.com/security/cve/CVE-2019-10723/ self
https://www.suse.com/security/cve/CVE-2019-9199/ self
https://www.suse.com/security/cve/CVE-2015-8981 external
https://bugzilla.suse.com/1023190 external
https://www.suse.com/security/cve/CVE-2017-5854 external
https://bugzilla.suse.com/1023070 external
https://bugzilla.suse.com/1096890 external
https://www.suse.com/security/cve/CVE-2017-6840 external
https://bugzilla.suse.com/1027787 external
https://www.suse.com/security/cve/CVE-2017-6841 external
https://bugzilla.suse.com/1027786 external
https://www.suse.com/security/cve/CVE-2017-6842 external
https://bugzilla.suse.com/1027785 external
https://www.suse.com/security/cve/CVE-2017-6845 external
https://bugzilla.suse.com/1027779 external
https://bugzilla.suse.com/1027781 external
https://www.suse.com/security/cve/CVE-2017-6849 external
https://bugzilla.suse.com/1027776 external
https://www.suse.com/security/cve/CVE-2017-8378 external
https://bugzilla.suse.com/1037000 external
https://www.suse.com/security/cve/CVE-2018-5308 external
https://bugzilla.suse.com/1075772 external
https://www.suse.com/security/cve/CVE-2019-10723 external
https://bugzilla.suse.com/1131544 external
https://www.suse.com/security/cve/CVE-2019-9199 external
https://bugzilla.suse.com/1127855 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for podofo",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for podofo fixes the following issues:\n\n - CVE-2015-8981: Fixed heap overflow in the function ReadXRefSubsection (bsc#1023190)\n - CVE-2017-6840: Fixed invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027787)\n - CVE-2017-6841: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h) (bsc#1027786)\n - CVE-2017-6842: Fixed NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027785)\n - CVE-2017-6845: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h) (bsc#1027779)\n - CVE-2017-6849: Fixed NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp) (bsc#1027776)\n - CVE-2017-8378: Fixed denial of service (application crash) vectors related to m_offsets.size (PdfParser::ReadObjects func in base/PdfParser.cpp) (bsc#1037000)  \n - CVE-2018-5308: Fixed Undefined behavior  (memcpy with NULL pointer) in PdfMemoryOutputStream::Write (src/base/PdfOutputStream.cpp) (bsc#1075772)\n - CVE-2019-10723: Fixed Memory leak in PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp (bsc#1131544)\n - CVE-2019-9199: Fixed NULL pointer dereference in function PoDoFo:Impose:PdfTranslator:setSource() in pdftranslator.cpp (bsc#1127855)\n\n - Fixed NULL pointer dereference in PdfInfo::GuessFormat (pdfinfo.cpp) (bsc#1023072)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2024-3541,SUSE-SLE-SDK-12-SP5-2024-3541,SUSE-SLE-WE-12-SP5-2024-3541",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3541-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2024:3541-1",
        "url": "https://www.suse.com/support/update/announcement/2024/suse-su-20243541-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2024:3541-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019558.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1023072",
        "url": "https://bugzilla.suse.com/1023072"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1023190",
        "url": "https://bugzilla.suse.com/1023190"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027776",
        "url": "https://bugzilla.suse.com/1027776"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027779",
        "url": "https://bugzilla.suse.com/1027779"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027785",
        "url": "https://bugzilla.suse.com/1027785"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027786",
        "url": "https://bugzilla.suse.com/1027786"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027787",
        "url": "https://bugzilla.suse.com/1027787"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1037000",
        "url": "https://bugzilla.suse.com/1037000"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1075772",
        "url": "https://bugzilla.suse.com/1075772"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1127855",
        "url": "https://bugzilla.suse.com/1127855"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131544",
        "url": "https://bugzilla.suse.com/1131544"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8981 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5854 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5854/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6840 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6840/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6841 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6841/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6842 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6842/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6845 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6845/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6849 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6849/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-8378 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-8378/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5308 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5308/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-10723 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-10723/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9199 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9199/"
      }
    ],
    "title": "Security update for podofo",
    "tracking": {
      "current_release_date": "2024-10-08T08:33:37Z",
      "generator": {
        "date": "2024-10-08T08:33:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2024:3541-1",
      "initial_release_date": "2024-10-08T08:33:37Z",
      "revision_history": [
        {
          "date": "2024-10-08T08:33:37Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpodofo-devel-0.9.2-3.21.1.aarch64",
                "product": {
                  "name": "libpodofo-devel-0.9.2-3.21.1.aarch64",
                  "product_id": "libpodofo-devel-0.9.2-3.21.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libpodofo0_9_2-0.9.2-3.21.1.aarch64",
                "product": {
                  "name": "libpodofo0_9_2-0.9.2-3.21.1.aarch64",
                  "product_id": "libpodofo0_9_2-0.9.2-3.21.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podofo-0.9.2-3.21.1.aarch64",
                "product": {
                  "name": "podofo-0.9.2-3.21.1.aarch64",
                  "product_id": "podofo-0.9.2-3.21.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpodofo-devel-0.9.2-3.21.1.i586",
                "product": {
                  "name": "libpodofo-devel-0.9.2-3.21.1.i586",
                  "product_id": "libpodofo-devel-0.9.2-3.21.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libpodofo0_9_2-0.9.2-3.21.1.i586",
                "product": {
                  "name": "libpodofo0_9_2-0.9.2-3.21.1.i586",
                  "product_id": "libpodofo0_9_2-0.9.2-3.21.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "podofo-0.9.2-3.21.1.i586",
                "product": {
                  "name": "podofo-0.9.2-3.21.1.i586",
                  "product_id": "podofo-0.9.2-3.21.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpodofo-devel-0.9.2-3.21.1.ppc64le",
                "product": {
                  "name": "libpodofo-devel-0.9.2-3.21.1.ppc64le",
                  "product_id": "libpodofo-devel-0.9.2-3.21.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libpodofo0_9_2-0.9.2-3.21.1.ppc64le",
                "product": {
                  "name": "libpodofo0_9_2-0.9.2-3.21.1.ppc64le",
                  "product_id": "libpodofo0_9_2-0.9.2-3.21.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podofo-0.9.2-3.21.1.ppc64le",
                "product": {
                  "name": "podofo-0.9.2-3.21.1.ppc64le",
                  "product_id": "podofo-0.9.2-3.21.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpodofo-devel-0.9.2-3.21.1.s390",
                "product": {
                  "name": "libpodofo-devel-0.9.2-3.21.1.s390",
                  "product_id": "libpodofo-devel-0.9.2-3.21.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libpodofo0_9_2-0.9.2-3.21.1.s390",
                "product": {
                  "name": "libpodofo0_9_2-0.9.2-3.21.1.s390",
                  "product_id": "libpodofo0_9_2-0.9.2-3.21.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "podofo-0.9.2-3.21.1.s390",
                "product": {
                  "name": "podofo-0.9.2-3.21.1.s390",
                  "product_id": "podofo-0.9.2-3.21.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpodofo-devel-0.9.2-3.21.1.s390x",
                "product": {
                  "name": "libpodofo-devel-0.9.2-3.21.1.s390x",
                  "product_id": "libpodofo-devel-0.9.2-3.21.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libpodofo0_9_2-0.9.2-3.21.1.s390x",
                "product": {
                  "name": "libpodofo0_9_2-0.9.2-3.21.1.s390x",
                  "product_id": "libpodofo0_9_2-0.9.2-3.21.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podofo-0.9.2-3.21.1.s390x",
                "product": {
                  "name": "podofo-0.9.2-3.21.1.s390x",
                  "product_id": "podofo-0.9.2-3.21.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libpodofo-devel-0.9.2-3.21.1.x86_64",
                "product": {
                  "name": "libpodofo-devel-0.9.2-3.21.1.x86_64",
                  "product_id": "libpodofo-devel-0.9.2-3.21.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libpodofo0_9_2-0.9.2-3.21.1.x86_64",
                "product": {
                  "name": "libpodofo0_9_2-0.9.2-3.21.1.x86_64",
                  "product_id": "libpodofo0_9_2-0.9.2-3.21.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podofo-0.9.2-3.21.1.x86_64",
                "product": {
                  "name": "podofo-0.9.2-3.21.1.x86_64",
                  "product_id": "podofo-0.9.2-3.21.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Workstation Extension 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Workstation Extension 12 SP5",
                  "product_id": "SUSE Linux Enterprise Workstation Extension 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-we:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpodofo-devel-0.9.2-3.21.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64"
        },
        "product_reference": "libpodofo-devel-0.9.2-3.21.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpodofo-devel-0.9.2-3.21.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le"
        },
        "product_reference": "libpodofo-devel-0.9.2-3.21.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpodofo-devel-0.9.2-3.21.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x"
        },
        "product_reference": "libpodofo-devel-0.9.2-3.21.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpodofo-devel-0.9.2-3.21.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64"
        },
        "product_reference": "libpodofo-devel-0.9.2-3.21.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libpodofo0_9_2-0.9.2-3.21.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 12 SP5",
          "product_id": "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        },
        "product_reference": "libpodofo0_9_2-0.9.2-3.21.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-8981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8981",
          "url": "https://www.suse.com/security/cve/CVE-2015-8981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1023190 for CVE-2015-8981",
          "url": "https://bugzilla.suse.com/1023190"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8981"
    },
    {
      "cve": "CVE-2017-5854",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5854"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5854",
          "url": "https://www.suse.com/security/cve/CVE-2017-5854"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1023070 for CVE-2017-5854",
          "url": "https://bugzilla.suse.com/1023070"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1096890 for CVE-2017-5854",
          "url": "https://bugzilla.suse.com/1096890"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5854"
    },
    {
      "cve": "CVE-2017-6840",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6840"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6840",
          "url": "https://www.suse.com/security/cve/CVE-2017-6840"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027787 for CVE-2017-6840",
          "url": "https://bugzilla.suse.com/1027787"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6840"
    },
    {
      "cve": "CVE-2017-6841",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6841"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6841",
          "url": "https://www.suse.com/security/cve/CVE-2017-6841"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027786 for CVE-2017-6841",
          "url": "https://bugzilla.suse.com/1027786"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6841"
    },
    {
      "cve": "CVE-2017-6842",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6842"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6842",
          "url": "https://www.suse.com/security/cve/CVE-2017-6842"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027785 for CVE-2017-6842",
          "url": "https://bugzilla.suse.com/1027785"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6842"
    },
    {
      "cve": "CVE-2017-6845",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6845"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6845",
          "url": "https://www.suse.com/security/cve/CVE-2017-6845"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027779 for CVE-2017-6845",
          "url": "https://bugzilla.suse.com/1027779"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027781 for CVE-2017-6845",
          "url": "https://bugzilla.suse.com/1027781"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6845"
    },
    {
      "cve": "CVE-2017-6849",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6849"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6849",
          "url": "https://www.suse.com/security/cve/CVE-2017-6849"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027776 for CVE-2017-6849",
          "url": "https://bugzilla.suse.com/1027776"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6849"
    },
    {
      "cve": "CVE-2017-8378",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-8378"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors related to m_offsets.size.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-8378",
          "url": "https://www.suse.com/security/cve/CVE-2017-8378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1037000 for CVE-2017-8378",
          "url": "https://bugzilla.suse.com/1037000"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-8378"
    },
    {
      "cve": "CVE-2018-5308",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5308"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5308",
          "url": "https://www.suse.com/security/cve/CVE-2018-5308"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1075772 for CVE-2018-5308",
          "url": "https://bugzilla.suse.com/1075772"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5308"
    },
    {
      "cve": "CVE-2019-10723",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-10723"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-10723",
          "url": "https://www.suse.com/security/cve/CVE-2019-10723"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131544 for CVE-2019-10723",
          "url": "https://bugzilla.suse.com/1131544"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-10723"
    },
    {
      "cve": "CVE-2019-9199",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9199"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9199",
          "url": "https://www.suse.com/security/cve/CVE-2019-9199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1127855 for CVE-2019-9199",
          "url": "https://bugzilla.suse.com/1127855"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:libpodofo-devel-0.9.2-3.21.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 12 SP5:libpodofo0_9_2-0.9.2-3.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-10-08T08:33:37Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-9199"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.