CVE catalog

CVE-2018-20797

libpodofo: CVE-2018-20797

Severity: Low · CVSS 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Feb 27, 2019, 5:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.35% · Oct 25, 2026

An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libpodofo	sid	`0.9.8+dfsg-3.3`	vulnerable
Debian	libpodofo	forky	`0.9.8+dfsg-3.3`	vulnerable
Debian	libpodofo	trixie	`0.9.8+dfsg-3.2`	vulnerable
Debian	libpodofo	bookworm	`0.9.8+dfsg-3`	vulnerable
Ubuntu	libpodofo	pro	`0.9.7+dfsg-2`	vulnerable
Ubuntu	libpodofo	pro	`0.9.7+dfsg-2build1`	vulnerable
Ubuntu	libpodofo	pro	`0.9.7+dfsg-2build2`	vulnerable
Ubuntu	libpodofo	pro	`0.9.7+dfsg-3`	vulnerable
Ubuntu	libpodofo	pro	`0.9.7+dfsg-3ubuntu0.1~esm1`	fixed
Suse	podofo	linux enterprise module for package hub 15 sp5	`0.9.6-150300.3.9.1`	fixed
Suse	podofo	linux enterprise module for package hub 15 sp6	`0.9.6-150300.3.9.1`	fixed
Opensuse	podofo	leap 15.5	`0.9.6-150300.3.9.1`	fixed
Opensuse	podofo	leap 15.6	`0.9.6-150300.3.9.1`	fixed
Opensuse	podofo	tumbleweed	`0.9.8-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libpodofo	source	sid	`(unfixed)`	unimportant	Not reported	[923415]
Debian	libpodofo	source	forky	`(unfixed)`	unimportant	Not reported	[923415]
Debian	libpodofo	source	trixie	`(unfixed)`	unimportant	Not reported	[923415]
Debian	libpodofo	source	bookworm	`(unfixed)`	unimportant	Not reported	[923415]
Ubuntu	libpodofo	deb	pro	`0.9.7+dfsg-3ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2018-20797	Not reported
Suse	podofo	rpm	linux enterprise module for package hub 15 sp5	`0.9.6-150300.3.9.1`	Not reported	SUSE-SU-2024:2137-1	Not reported
Suse	podofo	rpm	linux enterprise module for package hub 15 sp6	`0.9.6-150300.3.9.1`	Not reported	SUSE-SU-2024:2137-1	Not reported
Opensuse	podofo	rpm	leap 15.5	`0.9.6-150300.3.9.1`	Not reported	SUSE-SU-2024:2137-1	Not reported
Opensuse	podofo	rpm	leap 15.6	`0.9.6-150300.3.9.1`	Not reported	SUSE-SU-2024:2137-1	Not reported
Opensuse	podofo	rpm	tumbleweed	`0.9.8-1.1`	Not reported	OPENSUSE-SU-2024:12049-1	Not reported

[Debian bug #923415]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libpodofo0.9.8]Affected
Source package: [libpodofo]
Details (2)
- 0.9.8+dfsg-3+b1 · amd64 · bookworm
  Affected
  dsa · libpodofo · debian · bookworm; dsa · libpodofo · debian · 12
- 0.9.8+dfsg-3+b1 · arm64 · bookworm
  Affected
  dsa · libpodofo · debian · bookworm; dsa · libpodofo · debian · 12
[libpodofo-dev]Affected
Source package: [libpodofo]
Details (2)
- 0.9.8+dfsg-3+b1 · amd64 · bookworm
  Affected
  dsa · libpodofo · debian · bookworm; dsa · libpodofo · debian · 12
- 0.9.8+dfsg-3+b1 · arm64 · bookworm
  Affected
  dsa · libpodofo · debian · bookworm; dsa · libpodofo · debian · 12
[libpodofo-utils]Affected
Source package: [libpodofo]
Details (2)
- 0.9.8+dfsg-3+b1 · amd64 · bookworm
  Affected
  dsa · libpodofo · debian · bookworm; dsa · libpodofo · debian · 12
- 0.9.8+dfsg-3+b1 · arm64 · bookworm
  Affected
  dsa · libpodofo · debian · bookworm; dsa · libpodofo · debian · 12

[Debian 13 (Trixie)]

[libpodofo0.9.8t64]Affected
Source package: [libpodofo]
Details (2)
- 0.9.8+dfsg-3.2 · amd64 · trixie
  Affected
  dsa · libpodofo · debian · 13
- 0.9.8+dfsg-3.2 · arm64 · trixie
  Affected
  dsa · libpodofo · debian · 13
[libpodofo-dev]Affected
Source package: [libpodofo]
Details (2)
- 0.9.8+dfsg-3.2 · amd64 · trixie
  Affected
  dsa · libpodofo · debian · 13
- 0.9.8+dfsg-3.2 · arm64 · trixie
  Affected
  dsa · libpodofo · debian · 13
[libpodofo-utils]Affected
Source package: [libpodofo]
Details (2)
- 0.9.8+dfsg-3.2 · amd64 · trixie
  Affected
  dsa · libpodofo · debian · 13
- 0.9.8+dfsg-3.2 · arm64 · trixie
  Affected
  dsa · libpodofo · debian · 13

[openSUSE Tumbleweed]

[libpodofo4]Unknown
Source package: [podofo]
Details (1)
- 1.1.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.9.8-1.1
  Version impact unknown
  dsa · podofo · opensuse · tumbleweed
[libpodofo-devel]Unknown
Source package: [podofo]
Details (1)
- 1.1.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.9.8-1.1
  Version impact unknown
  dsa · podofo · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:36:09 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]