These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The veraPDF validation model, used for validating PDF files, contains an XML External Entity (XXE) vulnerability. This vulnerability affects versions 1.25.73 through 1.30.2 and 1.31.71. The issue allows for local file disclosure and outbound network requests when parsing rich-text annotations or form-field values and XFA configurations in untrusted PDFs. The vulnerability is fixed in versions 1.30.2 and 1.31.71.
A denial-of-service vulnerability exists in veraPDF PDF parser prior to versions 1.30.2 and 1.31.23. The vulnerability is triggered by a crafted Type 1 font /FontDescriptor /FontFile program, which can lead to unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups. This can cause validator memory, CPU, or stack exhaustion.
A denial-of-service vulnerability exists in veraPDF PDF parser versions prior to 1.30.2 and 1.31.23. The vulnerability is caused by unbounded PostScript array allocation or a zero-increment for loop when processing crafted Type 0 font /Encoding or /ToUnicode CMap streams, which can exhaust validator memory or CPU. This issue can impact PDF processing workflows, particularly those using veraPDF PDF parser, [truncated]
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expans [truncated]
The veraPDF validation model, used for PDF validation, contains an XML External Entity (XXE) vulnerability. This vulnerability, located in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java, allows for external entity expansion and the reflection of local file contents into the validation report when processing crafted PDFs. The issue affects veraPDF-validation versions fr [truncated]