Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-24808: pdfio library may freeze when opening crafted PDF files

CVE-2023-24808 · published 3 years ago

Summary

Versions of the pdfio library before 1.1.0 can get stuck using all CPU when they try to read a specially malformed PDF, causing the program to never finish. Any application that uses this library—for example web services that turn uploaded PDFs into text—can be stopped by an attacker sending such a file. The fix is simple: update pdfio to version 1.1.0 or later; there are no other work‑arounds.

What to do

Update debian ippsample to version 0.0~git20220215.f365352-1.
Update pdfio_project pdfio to version 1.1.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	ippsample	< 0.0~git20220215.f365352-1 Fix: upgrade to 0.0~git20220215.f365352-1
Debian:14	debian	ippsample	< 0.0~git20220215.f365352-1 Fix: upgrade to 0.0~git20220215.f365352-1
–	pdfio_project	pdfio	< 1.1.0 `cpe:2.3:a:pdfio_project:pdfio::::::::`
Ubuntu:18.04:LTS	canonical	ippsample	All versions

Original advisory text

Denial Of Service when opening a corrupt PDF file in pdfio

PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

https://security-tracker.debian.org/tracker/CVE-2023-24808 Vendor Advisory
https://ubuntu.com/security/CVE-2023-24808 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-24808 Third Party Advisory
https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-cjc4-x96x-fvgf Vendor Advisory
https://github.com/michaelrsweet/pdfio/commit/4f10021e7ee527c1aa24853e2947e38e15... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24808... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-24808 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')

Timeline

Published7 Feb 2023

Updated4 Nov 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2023-24808 · OSV

CVE-2023-24808 · NVD

UBUNTU-CVE-2023-24808 · OSV

CVE-2023-24808 · OSV

GHSA-cjc4-x96x-fvgf · GHSA

Track software like this

Free during beta