CVE-2022-25892 (published 2022-11-01T05:15Z)

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/julianhille/MuhammaraJS
commit_details: repo_url: https://github.com/julianhille/MuhammaraJS
author: Julian Hille
author_date: 2022-10-22 19:33:35+02:00
msg: Fix npe as backport for 2.x

Fixes #214
repository: repo_url: https://github.com/julianhille/MuhammaraJS
repo_name: julianhille/MuhammaraJS
description: Muhammara a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs)
repo_language: C
owner: julianhille
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Fixed
+
+- NPE in parser when file ends before it really starts
+
 ## [2.6.0] - 2022-06-30
 
 ### Changed

programming_language: Markdown
filename: PDFParser.cpp
change_type: ModificationType.MODIFY
diff: @@ -352,6 +352,12 @@ EStatusCode PDFParser::ParseLastXrefPosition()
 		mObjectParser.ResetReadState();
 		RefCountPtr<PDFObject> anObject(mObjectParser.ParseNewObject());
 
+		if (!anObject) {
+			status = PDFHummus::eFailure;
+			TRACE_LOG("PDFParser::ParseXrefPosition: Unable to find any object");
+			break;
+		}
+
 		if(anObject->GetType() == PDFObject::ePDFObjectInteger)
 		{
 			mLastXrefPosition = (LongFilePositionType)((PDFInteger*)anObject.GetPtr())->GetValue();

programming_language: C++
filename: SigSeg.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,12 @@
+var muhammara = require("../muhammara");
+const { expect } = require("chai");
+
+describe("SigSegv test", function () {
+  it("should read fields correctly", function () {
+    expect(() =>
+      muhammara.createReader(
+        __dirname + "/TestMaterials/BrokenPdfBadHeader.txt"
+      )
+    ).to.throw();
+  });
+});

programming_language: JavaScript
filename: BrokenPdfBadHeader.txt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+%PDF-1.4
+%%EOF
\ No newline at end of file

programming_language: Batchfile
repo_url: https://github.com/julianhille/MuhammaraJS
commit_details: repo_url: https://github.com/julianhille/MuhammaraJS
author: Julian Hille
author_date: 2022-10-22 19:31:05+02:00
msg: Fix NPE in pdf parser

Fixes #214
repository: repo_url: https://github.com/julianhille/MuhammaraJS
repo_name: julianhille/MuhammaraJS
description: Muhammara a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs)
repo_language: C
owner: julianhille
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Fixed
+
+- NPE in parser when file ends before it really starts
+
 ## [3.1.0] - 2022-09-30
 
 ### Changed

programming_language: Markdown
filename: PDFParser.cpp
change_type: ModificationType.MODIFY
diff: @@ -352,6 +352,12 @@ EStatusCode PDFParser::ParseLastXrefPosition()
 		mObjectParser.ResetReadState();
 		RefCountPtr<PDFObject> anObject(mObjectParser.ParseNewObject());
 
+		if (!anObject) {
+			status = PDFHummus::eFailure;
+			TRACE_LOG("PDFParser::ParseXrefPosition: Unable to find any object");
+			break;
+		}
+
 		if(anObject->GetType() == PDFObject::ePDFObjectInteger)
 		{
 			mLastXrefPosition = (LongFilePositionType)((PDFInteger*)anObject.GetPtr())->GetValue();

programming_language: C++
filename: SigSeg.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,12 @@
+var muhammara = require("../muhammara");
+const { expect } = require("chai");
+
+describe("SigSegv test", function () {
+  it("should read fields correctly", function () {
+    expect(() =>
+      muhammara.createReader(
+        __dirname + "/TestMaterials/BrokenPdfBadHeader.txt"
+      )
+    ).to.throw();
+  });
+});

programming_language: JavaScript
filename: BrokenPdfBadHeader.txt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+%PDF-1.4
+%%EOF
\ No newline at end of file

programming_language: Batchfile