Medium severity · published Mar 19, 2021
CVE-2021-27807
A carefully crafted PDF file can trigger an infinite loop while loading the file
5.5
CVSS
3%
EPSS
No
On KEV
Description
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BT
Banking Trade Finance Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BT
Banking Treasury Management · Oracle
14.5 · source: NVD
BV
Banking Virtual Account Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
CS
Communications Session Report Manager · Oracle
8.0.0 through 8.2.4.0 · source: NVD
FE
Fedora · Fedoraproject
32; 33; 34 · source: NVD
FU
Flexcube Universal Banking · Oracle
14.0.0 through 14.3.0; 14.5.0 · source: NVD
HF
Hyperion Financial Reporting · Oracle
11.1.2.4; 11.2.6.0 · source: NVD
HI
Hyperion Infrastructure Technology · Oracle
before 11.2.8.0 · source: NVD
OI
Outside IN Technology · Oracle
8.5.5 · source: NVD
PD
Pdfbox · Apache
2.0.0 through 2.0.22 · source: NVD
PU
Primavera Unifier · Oracle
17.7 through 17.12; 18.8; 19.12; 20.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27807
Mailing List
http://www.openwall.com/lists/oss-security/2021/03/19/9
lists.apache.org
https://lists.apache.org/thread.html/r043edc5dcf9199f7f882ed7906b41cb816753766e88b8792dbf319a9%40%3Cannounce.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r4717f902f8bc36d47b3fa978552a25e4ed3ddc2fffb52b94fbc4ab36%40%3Cusers.pdfbox.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
More from Pdfbox
9.8
CVE-2019-0228
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF
7.8
CVE-2016-2175
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE)…
6.5
CVE-2018-8036
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache…
5.5
CVE-2021-31812
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file
5.5
CVE-2021-31811
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file