CVE-2018-8036
libfontbox2-java: In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite...
CVE-2018-8036 is fixed in 5 products on 1 platform, first by libfontbox-java 1:1.8.16-2~18.04, released October 5, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0399
90th percentile
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libfontbox-java · Ubuntu 18.04.6 LTS (bionic) | 1:1.8.16-2~18.04 | libfontbox-java 1:1.8.16-2~18.04 | Oct 5, 2018 |
| libfontbox2-java · Ubuntu 18.04.6 LTS (bionic) | 2.0.13-2~18.04 | libfontbox2-java 2.0.13-2~18.04 | Oct 5, 2018 |
| libjempbox-java · Ubuntu 18.04.6 LTS (bionic) | 1:1.8.16-2~18.04 | libjempbox-java 1:1.8.16-2~18.04 | Oct 5, 2018 |
| libpdfbox-java · Ubuntu 18.04.6 LTS (bionic) | 1:1.8.16-2~18.04 | libpdfbox-java 1:1.8.16-2~18.04 | Oct 5, 2018 |
| libpdfbox2-java · Ubuntu 18.04.6 LTS (bionic) | 2.0.13-2~18.04 | libpdfbox2-java 2.0.13-2~18.04 | Oct 5, 2018 |