{"id":"CVE-2015-8981","aliases":["DEBIAN-CVE-2015-8981","DLA-929-1","EUVD-2015-8835","GHSA-w4xc-2f8w-q8h5","SUSE-SU-2024:3541-1","SUSE-SU-2024:3550-1","UBUNTU-CVE-2015-8981"],"status":"published","title":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in...","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02618,"percentile":0.85558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-03-16T15:00:00Z","modified":"2026-09-09T07:02:09Z","fixes":[{"ecosystem":"Debian:12","package":"libpodofo","fixed_in":["0.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpodofo","fixed_in":["0.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpodofo","fixed_in":["0.9.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libpodofo","fixed_in":["0.9.0-1.2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-1.1+deb7u1"}]}],"versions":["0.9.0-1.1"],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-1.2ubuntu0.1~esm1"}]}],"versions":["0.9.0-1.1ubuntu1","0.9.0-1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1.3","0.9.3-3","0.9.3-4","0.9.3-4ubuntu0.1~esm1"]}],"products":[{"vendor":"podofo_project","product":"podofo"}],"references":[{"url":"https://sourceforge.net/p/podofo/mailman/message/34205419/","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2017/02/01/20","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2017/02/02/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://sourceforge.net/p/podofo/code/1672","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8981"},{"url":"https://sourceforge.net/p/podofo/mailman/message/34205419"},{"url":"https://github.com/advisories/GHSA-w4xc-2f8w-q8h5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8981","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243541-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1023072","tags":["report"]},{"url":"https://bugzilla.suse.com/1023190","tags":["report"]},{"url":"https://bugzilla.suse.com/1027776","tags":["report"]},{"url":"https://bugzilla.suse.com/1027779","tags":["report"]},{"url":"https://bugzilla.suse.com/1027785","tags":["report"]},{"url":"https://bugzilla.suse.com/1027786","tags":["report"]},{"url":"https://bugzilla.suse.com/1027787","tags":["report"]},{"url":"https://bugzilla.suse.com/1037000","tags":["report"]},{"url":"https://bugzilla.suse.com/1075772","tags":["report"]},{"url":"https://bugzilla.suse.com/1127855","tags":["report"]},{"url":"https://bugzilla.suse.com/1131544","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9199","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243550-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1075322","tags":["report"]},{"url":"https://bugzilla.suse.com/1084894","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8001","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8981","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=148601605717859\u0026w=2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8981","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8981","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2017-03-16T15:00:00Z","modified":"2024-08-06T08:36:31.149Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8835","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2017-03-16T15:00:00Z","modified":"2024-08-06T08:36:31Z","updated_at":"2026-11-03T01:57:25.349664Z"}],"ghsa":[{"id":"GHSA-w4xc-2f8w-q8h5","title":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in...","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2022-05-17T02:54:32Z","modified":"2025-04-20T03:34:12Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:41.326693Z"}],"nvd":[{"id":"CVE-2015-8981","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2017-03-16T15:59:00.727Z","modified":"2026-06-17T00:35:36.783Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"CVE-2015-8981","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2017-03-16T15:59:00Z","modified":"2026-04-10T03:45:37.514647Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8981","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2017-03-16T15:59:00.727Z","modified":"2026-09-09T07:02:09.428765741Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2015-8981","description":"Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.","status":"published","published":"2017-03-16T15:59:00Z","modified":"2026-04-22T10:25:17.232992Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DLA-929-1","title":"libpodofo - security update","status":"published","published":"2017-04-29T00:00:00Z","modified":"2026-03-09T02:10:54.910727Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"SUSE-SU-2024:3541-1","title":"Security update for podofo","description":"This update for podofo fixes the following issues:\n\n - CVE-2015-8981: Fixed heap overflow in the function ReadXRefSubsection (bsc#1023190)\n - CVE-2017-6840: Fixed invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027787)\n - CVE-2017-6841: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h) (bsc#1027786)\n - CVE-2017-6842: Fixed NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027785)\n - CVE-2017-6845: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h) (bsc#1027779)\n - CVE-2017-6849: Fixed NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp) (bsc#1027776)\n - CVE-2017-8378: Fixed denial of service (application crash) vectors related to m_offsets.size (PdfParser::ReadObjects func in base/PdfParser.cpp) (bsc#1037000)  \n - CVE-2018-5308: Fixed Undefined behavior  (memcpy with NULL pointer) in PdfMemoryOutputStream::Write (src/base/PdfOutputStream.cpp) (bsc#1075772)\n - CVE-2019-10723: Fixed Memory leak in PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp (bsc#1131544)\n - CVE-2019-9199: Fixed NULL pointer dereference in function PoDoFo:Impose:PdfTranslator:setSource() in pdftranslator.cpp (bsc#1127855)\n\n - Fixed NULL pointer dereference in PdfInfo::GuessFormat (pdfinfo.cpp) (bsc#1023072)\n","status":"published","published":"2024-10-08T08:33:37Z","modified":"2026-02-04T03:22:38.825984Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3550-1","title":"Security update for podofo","description":"This update for podofo fixes the following issues:\n\n - CVE-2015-8981: Fixed heap overflow in the function ReadXRefSubsection (bsc#1023190)\n - CVE-2017-6840: Fixed invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027787)\n - CVE-2017-6841: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h) (bsc#1027786)\n - CVE-2017-6842: Fixed NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027785)\n - CVE-2017-6845: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h) (bsc#1027779)\n - CVE-2017-6849: Fixed NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp) (bsc#1027776)\n - CVE-2017-8378: Fixed denial of service (application crash) vectors related to m_offsets.size (PdfParser::ReadObjects func in base/PdfParser.cpp) (bsc#1037000)  \n\n - Fixed NULL pointer dereference in PdfInfo::GuessFormat (pdfinfo.cpp) (bsc#1023072)\n","status":"published","published":"2024-10-08T14:07:52Z","modified":"2026-02-04T03:54:33.100214Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}