In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the     file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions. (CVE-2021-31811)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the
    file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions. (CVE-2021-31811)

The 17.12, 18.8, 19.12, and 20.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Security-in-Depth issue in the Oracle Spatial and Graph Network Data Model (jackson-databind) component of     Oracle Primavera Unifier. (CVE-2020-36189)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core     (Apache PDFbox)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Primavera     Unifier executes to compromise Primavera Unifier. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2021-27906)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core UI     (dojo)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Primavera Unifier accessible data. (CVE-2020-5258)

  - Security-in-Depth issue in the Oracle Spatial and Graph Network Data Model (jackson-databind) component of     Oracle Database Server. This vulnerability cannot be exploited in the context of this product.
    (CVE-2020-25649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259819	Linux Distros Unpatched Vulnerability : CVE-2021-31811	Nessus	Misc.	medium
414491	SCA: security update for org.apache.pdfbox:pdfbox, org.apache.pdfbox:pdfbox-parent (GHSA-fg3j-q579-v8x4)	Tenable Cloud Security	SCA Checks	medium
414491	SCA: security update for org.apache.pdfbox:pdfbox, org.apache.pdfbox:pdfbox-parent (GHSA-fg3j-q579-v8x4)	Tenable Self-Hosted Container Security	SCA Checks	medium
151973	Oracle Primavera Unifier (Jul 2021 CPU)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2021-31811

medium

Tenable Plugins

medium

medium

medium

high