Loop with Unreachable Exit Condition ('Infinite Loop') Affecting libpdfbox2-java package, versions <2.0.11-1


Severity

Recommended
low

Based on Debian security rating

    Threat Intelligence

    EPSS
    0.66% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN10-LIBPDFBOX2JAVA-263216
  • published 11 Jul 2018
  • disclosed 3 Jul 2018

How to fix?

Upgrade Debian:10 libpdfbox2-java to version 2.0.11-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpdfbox2-java package and not the libpdfbox2-java package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.