Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial Of Service when opening a corrupt PDF file in pdfio
Vulnerability Description
PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability Type
不可达退出条件的循环(无限循环)
Vulnerability Title
PDFio 安全漏洞
Vulnerability Description
PDFio是一个简单的 C 库，用于读取和写入 PDF 文件。 PDFio 1.1.0 版本存在安全漏洞，该漏洞源于精心制作的 pdf 文件可能导致拒绝服务攻击。
CVSS Information
N/A
Vulnerability Type
N/A