Bug 1081307 (CVE-2018-7174)

Summary:	VUL-1: CVE-2018-7174: xpdf: An infinite loop in XRef::Xref allows an attacker to cause denial of service because loop detection exists only for tables, not streams.
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Karol Babioch <karol>
Component:	Incidents	Assignee:	Peter Simons <peter.simons>
Status:	RESOLVED INVALID	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	pgajdos, smash_bz, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/200310/
Whiteboard:	CVSSv3:SUSE:CVE-2018-7174:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSSv2:NVD:CVE-2018-7174:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2018-7174:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSSv3:SUSE:CVE-2018-7174:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) maint:planned:update
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1133493

Description Karol Babioch 2018-02-16 09:01:09 UTC

CVE-2018-7174

An issue was discovered in xpdf 4.00. An infinite loop in XRef::Xref allows an
attacker to cause denial of service because loop detection exists only for
tables, not streams.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1546052
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7174
http://www.cvedetails.com/cve/CVE-2018-7174/
https://forum.xpdfreader.com/viewtopic.php?f=3&t=605
https://forum.xpdfreader.com/viewtopic.php?f=3&amp;t=605

Comment 1 Peter Simons 2018-06-21 09:20:04 UTC

No fix was published for this issue. Upstream says they fixed it in their own source code but they did not share the actual diff. There is a vague description saying

> The XRef class has loop detection code, but it was only 
> checking xref tables, and not xref streams. The fix was
> simple: just move the detection code from XRef::readXRefTable()
> to XRef::readXRef().

but I am not sure how to translate that into an actually applicable patch. Red Hat doesn't have a fix either yet; both of their tracker bugs remain open.

Comment 2 Petr Gajdos 2023-06-12 09:53:40 UTC

Testcase:

https://github.com/skysider/FuzzVuln/blob/master/xpdf_pdftohtml_infinite_loop_XRef_XRef.pdf

I can reproduce the infinite loop in 11sp1/poppler only.

Comment 3 Petr Gajdos 2023-06-13 06:48:21 UTC

(In reply to Petr Gajdos from comment #2)
> Testcase:
> 
> https://github.com/skysider/FuzzVuln/blob/master/
> xpdf_pdftohtml_infinite_loop_XRef_XRef.pdf
> 
> I can reproduce the infinite loop in 11sp1/poppler only.

However, 11sp1/poppler is not maintained anymore. Suggest to close this.