libpodofo (Ubuntu:24.10) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Ubuntu:24.10 package libpodofo, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (7)

• CVE-2023-31566 — CVSS 8.8 (high): Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted().
• CVE-2023-31567 — CVSS 8.8 (high): Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.
• CVE-2023-31568 — CVSS 8.8 (high): Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4.
• CVE-2018-8000 — CVSS 8.8 (high): In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a…
• CVE-2023-31556 — CVSS 6.5 (medium): podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.
• CVE-2023-31555 — CVSS 6.5 (medium): podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.
• CVE-2023-2241 — CVSS 5.3 (medium): A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file…