Heap-based Buffer Overflow in PoDoFo Product
CVE-2017-6843

7.8HIGH

Key Information:

Vendor

Podofo Project

Status
Podofo
Vendor
CVE Published:
15 March 2017

What is CVE-2017-6843?

A heap-based buffer overflow vulnerability exists within the PoDoFo library in the DelayedLoad function found in PdfVariant.h. This flaw allows remote attackers to potentially exploit the vulnerability by sending specifically crafted PDF files to an unsuspecting user. Successful exploitation could result in unexpected behavior of the application, leading to various undesirable outcomes, including system crashes or arbitrary code execution.

References

https://blogs.gentoo.org/ago/2017/03/02/podofo-heap-based...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.