Priority HIGH 68
A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00396 · Published 2025-10-01 · No fix listed CWE-416
Priority MEDIUM 55
A flaw has been found in PoDoFo 1.1.0-dev.
CVSS 4.0MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00219 · Published 2025-08-24 · No fix listed CWE-119
Priority MEDIUM 41
Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00755 · Published 2023-05-10 · No fix listed CWE-787
Priority HIGH 73
Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00746 · Published 2023-05-10 · No fix listed CWE-787
Priority HIGH 73
Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted().
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0074 · Published 2023-05-10 · No fix listed CWE-416
Priority HIGH 71
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00704 · Published 2023-05-10 · No fix listed CWE-787
Priority LOW 30
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0064 · Published 2023-05-10 · No fix listed
Priority HIGH 69
A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00372 · Published 2023-04-22 · No fix listed CWE-122
Priority LOW 26
Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component 'src/base/PdfToenizer.cpp'.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0076 · Published 2021-08-25 · No fix listed CWE-668
Priority LOW 26
Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0068 · Published 2021-08-25 · No fix listed CWE-787
Priority LOW 35
A flaw was found in PoDoFo 0.9.7.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00763 · Published 2021-05-26 · No fix listed CWE-119
Priority LOW 26
A flaw was found in PoDoFo 0.9.7.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00726 · Published 2021-05-26 · No fix listed CWE-674
Priority LOW 26
A flaw was found in PoDoFo 0.9.7.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00688 · Published 2021-05-26 · No fix listed CWE-674
Priority LOW 26
A flaw was found in PoDoFo 0.9.7.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00704 · Published 2021-05-26 · No fix listed CWE-416
Priority LOW 28
The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01365 · Published 2019-12-30 · No fix listed CWE-476
Priority LOW 27
An issue was discovered in PoDoFo 0.9.6.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00984 · Published 2019-04-03 · No fix listed CWE-770
Priority MEDIUM 46
PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02203 · Published 2019-03-11 · No fix listed CWE-787
Priority LOW 32
An issue was discovered in PoDoFo 0.9.6.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01351 · Published 2019-02-27 · No fix listed CWE-119
Priority MEDIUM 43
PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02552 · Published 2019-02-26 · No fix listed CWE-476
Priority MEDIUM 41
An issue was discovered in crop_page in PoDoFo 0.9.6.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01638 · Published 2019-02-04 · No fix listed CWE-476
Priority MEDIUM 41
A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01659 · Published 2018-11-26 · No fix listed CWE-476
Priority LOW 33
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02359 · Published 2018-09-17 · No fix listed CWE-119
Priority LOW 36
A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.00968 · Published 2018-06-29 · No fix listed CWE-125
Priority LOW 27
Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01068 · Published 2018-06-29 · No fix listed CWE-119
Priority LOW 32
An issue was discovered in PoDoFo 0.9.5.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01339 · Published 2018-05-18 · No fix listed CWE-476
Load more
THREATIST.IORead the docs