Alpine: multiple podofo packages: security update to 0.9.7-r0

critical Tenable Cloud Security Plugin ID 406435

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.
(CVE-2019-9687)

- A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in
pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It
allows an attacker to cause Denial of Service. (CVE-2018-19532)

- An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document,
pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be problematic due to the function
GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which
causes a NULL pointer dereference. (CVE-2018-20751)

- An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in
PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from
PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp. (CVE-2018-20797)

- PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer
dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary.
It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other
impact. (CVE-2019-9199)

Plugin Details

Severity: Critical

ID: 406435

Version: Revision 1.26

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 12/4/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-9687

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 11/26/2018

Reference Information

CVE: CVE-2018-19532, CVE-2018-20751, CVE-2018-20797, CVE-2019-10723, CVE-2019-20093, CVE-2019-9199, CVE-2019-9687

Detections

Analytics