Loop with Unreachable Exit Condition in Apache PDFBox

Also known as GHSA-j2xq-pfff-mvgg

Published 8 y ago 2018-07-03 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

4.0%

percentile 91%

Public exploits

none known

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Exploit prediction (EPSS)

3.99% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:N/A:P`
GitHub	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.pdfbox:pdfbox`	>=1.8.0, <1.8.15 >=2.0.0RC1, <2.0.11	1.8.15 2.0.11

Affected products

Apache Software Foundation Apache PDFBox

Classification

Weakness

CWE-835 Loop with Unreachable Exit Condition

References

access.redhat.com /errata/RHSA-2018:2669 · vendor-advisory, x_refsource_REDHAT, x_transferred
lists.apache.org /thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6%40%3Cusers.pdfbox.ap · mailing-list, x_refsource_MLIST, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5 · vendor-advisory, x_refsource_FEDORA, x_transferred
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJH · vendor-advisory, x_refsource_FEDORA, x_transferred
oracle.com /security-alerts/cpuapr2020.html · x_refsource_MISC, x_transferred
lists.apache.org /thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.ap · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-8036 · advisory
lists.apache.org /thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6@%3Cusers.pdfbox.apac · web
lists.apache.org /thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540@%3Cdev.syncope.apac · web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRD · web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IV · web

Sources

CVE List: CVE-2018-8036
GitHub Advisory: GHSA-j2xq-pfff-mvgg
NVD: CVE-2018-8036

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary