Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-11797

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Published

2018-10-05T20:29:00.250

Last Modified

2024-11-21T03:44:03.213

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache pdfbox ≤ 1.8.15 Yes
Application apache pdfbox ≤ 2.0.11 Yes
Application apache pdfbox 2.0 Yes
Application apache pdfbox 2.0 Yes
Application apache pdfbox 2.0 Yes
Application apache pdfbox 2.0.0 Yes
Operating System fedoraproject fedora 29 Yes
Operating System fedoraproject fedora 30 Yes
Application oracle retail_xstore_point_of_service 17.0 Yes
References