FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
The advisory, in context
Impact
This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeated attacks can lead to sustained service unavailability.
Patches
Fixed as of version 2.6.7
Workarounds
No.
References
No.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.6.7
Fixed in 2.6.7
34 explicitly affected versions
1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.6.1, 1.6.2, v2.0.0, v2.0.0-beta, v2.0.0-beta2, v2.0.0-rc1, v2.0.1, v2.0.2, v2.0.3, v2.1.0, v2.1.1, v2.2.0, v2.3.0, v2.3.1, v2.3.2, v2.3.3, v2.3.4, v2.3.5, v2.3.6, v2.3.7, v2.4.0, v2.4.1, v2.5.0, v2.6.0, v2.6.1, v2.6.2, v2.6.3, v2.6.4, v2.6.5, v2.6.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.5.2",
"1.5.3",
"1.5.4",
"1.6.0",
"1.6.1",
"1.6.2",
"v2.0.0",
"v2.0.0-beta",
"v2.0.0-beta2",
"v2.0.0-rc1",
"v2.0.1",
"v2.0.2",
"v2.0.3",
"v2.1.0",
"v2.1.1",
"v2.2.0",
"v2.3.0",
"v2.3.1",
"v2.3.2",
"v2.3.3",
"v2.3.4",
"v2.3.5",
"v2.3.6",
"v2.3.7",
"v2.4.0",
"v2.4.1",
"v2.5.0",
"v2.6.0",
"v2.6.1",
"v2.6.2",
"v2.6.3",
"v2.6.4",
"v2.6.5",
"v2.6.6"
]
}