Lucene search

[email protected]CVE-2018-8036

HistoryJul 03, 2018 - 8:29 p.m.

CVE-2018-8036

2018-07-0320:29:00

CWE-835

[email protected]

web.nvd.nist.gov

apache

pdfbox

vulnerability

infinite loop

out of memory

cve-2018-8036

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.8 Medium

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.8%

JSON

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox’s AFMParser.

Affected configurations

Vulners

NVD

Node

apachepdfboxRange1.8.0–1.8.14

apachepdfboxRange2.0.0RC1–2.0.10

CPENameOperatorVersion
apache:pdfboxapache pdfboxle1.8.14
apache:pdfboxapache pdfboxle2.0.10
apache:pdfboxapache pdfboxeq2.0.0

CPE	Name	Operator	Version
apache:pdfbox	apache pdfbox	le	1.8.14
apache:pdfbox	apache pdfbox	le	2.0.10
apache:pdfbox	apache pdfbox	eq	2.0.0

CNA Affected

[
  {
    "product": "Apache PDFBox",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.8.0 to 1.8.14"
      },
      {
        "status": "affected",
        "version": "2.0.0RC1 to 2.0.10"
      }
    ]
  }
]