{"id":"CVE-2019-20093","aliases":["ALPINE-CVE-2019-20093","DEBIAN-CVE-2019-20093","EUVD-2019-10649","GHSA-9h85-988j-4f98","MGASA-2020-0294","SUSE-SU-2022:1316-1","SUSE-SU-2022:1690-1","UBUNTU-CVE-2019-20093","openSUSE-SU-2024:14278-1"],"status":"published","title":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote...","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01365,"percentile":0.72051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2019-12-30T03:47:57Z","modified":"2026-11-03T06:31:56Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpodofo","fixed_in":["0.9.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpodofo","fixed_in":["0.9.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpodofo","fixed_in":["0.9.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"podofo","fixed_in":["0.9.6-150300.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"podofo","fixed_in":["0.9.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"podofo","fixed_in":["0.9.2-3.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.1.mga7"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"podofo_project","product":"podofo"}],"references":[{"url":"https://sourceforge.net/p/podofo/tickets/75/","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHFOCBZCF3GX7A6FWE3JM7P37TQWGINJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTB2J5XWOEGAJYR2N66GAECUIKDG6O2S/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20093"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTB2J5XWOEGAJYR2N66GAECUIKDG6O2S/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHFOCBZCF3GX7A6FWE3JM7P37TQWGINJ/"},{"url":"https://github.com/advisories/GHSA-9h85-988j-4f98"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-20093","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20093","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0294.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24385","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Y6ZKYPW55PN6XV5XW6KZDIJLWRXON74N/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5Z7UF3AC76HHLSAHVBUQWMYXHR33DR34/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4K6FST3UH3WNUNCIAEEGZJJASCP5ZXUF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SSB4HRLHF7H3DPNTFPTXUE6EGXXZ5JSZ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WR6XY3TOLJPLXOGHYPCB42JW3SWRZNY4/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221316-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159921","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20093","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221690-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20093","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20093","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9199","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-20093","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2019-12-30T03:47:57Z","modified":"2024-08-05T02:32:10.605Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-10649","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2019-12-30T03:47:57Z","modified":"2024-08-05T02:32:10Z","updated_at":"2026-11-03T02:40:23.251012Z"}],"ghsa":[{"id":"GHSA-9h85-988j-4f98","title":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote...","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2022-05-24T17:05:21Z","modified":"2023-01-28T05:06:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:44:25.86191Z"}],"nvd":[{"id":"CVE-2019-20093","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2019-12-30T04:15:11.267Z","modified":"2026-06-17T02:29:57.767Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:41.313583Z"}],"osv":[{"id":"ALPINE-CVE-2019-20093","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2019-12-30T04:15:11.267Z","modified":"2026-11-03T06:31:56.013749657Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-20093","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2019-12-30T04:15:11.267Z","modified":"2026-10-24T10:30:49.338093494Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20093","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"published","published":"2019-12-30T04:15:11.267Z","modified":"2026-09-21T07:03:17.012995268Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-20093","description":"The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.","status":"withdrawn","published":"2019-12-30T04:15:00Z","modified":"2026-07-21T18:19:05.501441562Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"MGASA-2020-0294","title":"Updated podofo packages fix security vulnerability","description":"The updated packages fix security vulnerabilities:\n\nA stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey()\nfunction in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote \nattackers to cause a denial-of-service via a crafted pdf file. (CVE-2018-12983)\n\nAn issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document,\npPage-\u003eGetObject()-\u003eGetDictionary().AddKey(PdfName(\"MediaBox\"),var) can be\nproblematic due to the function GetObject() being called for the pPage NULL\npointer object. The value of pPage at this point is 0x0, which causes a NULL\npointer dereference. (CVE-2018-20751)\n\nPoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6\nhas a NULL pointer dereference that can (for example) be triggered by sending a\ncrafted PDF file to the podofoimpose binary. It allows an attacker to cause\nDenial of Service (Segmentation fault) or possibly have unspecified other impact.\n(CVE-2019-9199)\n\nPoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in\nbase/PdfString.cpp. (CVE-2019-9687)\n\nThe PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows\nremote attackers to cause a denial of service (NULL pointer dereference) via a\ncrafted file, because of ImageExtractor.cpp. (CVE-2019-20093)\n","status":"published","published":"2020-07-30T13:06:40Z","modified":"2026-04-16T04:44:36.973298002Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:14278-1","title":"libpodofo-devel-0.10.3-2.1 on GA media","description":"These are all security issues fixed in the libpodofo-devel-0.10.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-20T00:00:00Z","modified":"2025-05-07T18:10:11.812464Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2022:1316-1","title":"Security update for podofo","description":"This update for podofo fixes the following issues:\n\n- CVE-2019-20093: Fixed an invalid memory access that could cause an application\n  crash (bsc#1159921).\n","status":"published","published":"2022-04-22T15:00:45Z","modified":"2026-02-04T02:31:11.639335Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1690-1","title":"Security update for podofo","description":"This update for podofo fixes the following issues:\n\n- CVE-2019-20093: Fixed an invalid memory access that could cause an application\n  crash (bsc#1159921). \n","status":"published","published":"2022-05-16T12:11:07Z","modified":"2026-02-04T03:30:40.709769Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}