{"id":"CVE-2018-11797","aliases":["DEBIAN-CVE-2018-11797","DLA-1547-1","EUVD-2018-0607","GHSA-gx96-vgf7-hwfg","SUSE-SU-2018:3318-1","SUSE-SU-2018:3755-1","UBUNTU-CVE-2018-11797","openSUSE-SU-2024:10622-1"],"status":"published","title":"In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03505,"percentile":0.89269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-10-05T20:00:00Z","modified":"2026-10-24T10:30:55Z","fixes":[{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","fixed_in":["1.8.16","2.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libpdfbox-java","fixed_in":["1:1.8.16-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpdfbox-java","fixed_in":["1:1.8.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpdfbox-java","fixed_in":["1:1.8.16-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpdfbox2-java","fixed_in":["2.0.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpdfbox2-java","fixed_in":["2.0.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpdfbox2-java","fixed_in":["2.0.12-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libpdfbox-java","fixed_in":["1:1.8.7+dfsg-1+deb8u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"apache-pdfbox","fixed_in":["1.8.12-5.6.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox-java","fixed_in":["1:1.8.16-2~18.04"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox2-java","fixed_in":["2.0.13-2~18.04"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.16-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.16-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.7+dfsg-1+deb8u2"}]}],"versions":["1:1.8.7+dfsg-1","1:1.8.7+dfsg-1+deb8u1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.16"}]}],"versions":["1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"apache-pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-3.5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"apache-pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-5.6.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.7+dfsg-1","1:1.8.10-1","1:1.8.10-2","1:1.8.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.16-2~18.04"}]}],"versions":["1:1.8.13-1","1:1.8.13-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libpdfbox2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-2~18.04"}]}],"versions":["2.0.7-1","2.0.8-1","2.0.8-2","2.0.9-1"]}],"products":[{"vendor":"apache","product":"pdfbox"},{"vendor":"apache software foundation","product":"apache pdfbox"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"retail_xstore_point_of_service"}],"references":[{"url":"https://lists.apache.org/thread.html/645574bc50b886d39c20b4065d51ccb1cd5d3a6b4750a22edbb565eb%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361d91006b663a0a418d34a%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11797","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gx96-vgf7-hwfg","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/645574bc50b886d39c20b4065d51ccb1cd5d3a6b4750a22edbb565eb@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361d91006b663a0a418d34a@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8@%3Cdev.pdfbox.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11797","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1099721","tags":["report"]},{"url":"https://bugzilla.suse.com/1111009","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8036","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183755-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-11797","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/10/05/4","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11797","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27906","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-11797","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-05T20:00:00Z","modified":"2024-09-16T16:33:51.092Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2018-0607","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-05T20:00:00Z","modified":"2024-09-16T16:33:51Z","updated_at":"2026-11-03T00:55:50.035364Z"}],"ghsa":[{"id":"GHSA-gx96-vgf7-hwfg","title":"In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-17T18:22:29Z","modified":"2023-02-01T05:03:50Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2018-11797","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-05T20:29:00.25Z","modified":"2026-06-17T01:36:37.027Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:42.52179Z"}],"osv":[{"id":"CVE-2018-11797","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-05T20:29:00.25Z","modified":"2026-10-24T10:30:55.210956148Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-11797","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-05T20:29:00.25Z","modified":"2026-10-23T18:02:59.032492711Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"GHSA-gx96-vgf7-hwfg","title":"In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-17T18:22:29Z","modified":"2024-02-16T08:14:19.885368Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"UBUNTU-CVE-2018-11797","description":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.","status":"published","published":"2018-10-05T20:29:00Z","modified":"2025-10-24T04:47:03Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1547-1","title":"libpdfbox-java - security update","status":"published","published":"2018-10-16T00:00:00Z","modified":"2026-03-09T01:00:58.977957Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"openSUSE-SU-2024:10622-1","title":"apache-pdfbox-2.0.23-1.3 on GA media","description":"These are all security issues fixed in the apache-pdfbox-2.0.23-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:36.965582Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:3318-1","title":"Security update for apache-pdfbox","description":"This update for apache-pdfbox fixes the following security issue:\n\n- CVE-2018-8036: A crafted file could have triggered an infinite loop which lead to DoS (bsc#1099721).\n- CVE-2018-11797: A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. (bsc#1111009):\n","status":"published","published":"2018-10-23T09:13:37Z","modified":"2026-02-04T02:38:45.719508Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3755-1","title":"Security update for apache-pdfbox","description":"\nThis update for apache-pdfbox fixes the following security issue:\n\n- CVE-2018-11797: A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. (bsc#1111009):\n\n","status":"published","published":"2018-11-13T07:36:20Z","modified":"2026-02-04T04:40:29.315417Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}