[Bugs] [Bug 13245] New: itext 2.1.7 CVEs found

[bugzilla]

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13245

          Platform: ---
            Bug ID: 13245
           Summary: itext 2.1.7 CVEs found
    Classification: ROSA-based products
           Product: Certified ROSA distros
           Version: Chrome
          Hardware: All
               URL: CVE-2017-9096, CVE-2022-24196, CVE-2022-24197,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
  Target Milestone: ---
             Group: ROSA-plus-NTCIT
             Flags: secteam_verified?

Please patch CVEs for package itext version 2.1.7  
INFO (CVEs are): itext 2.1.7 cves found
CVE-2017-9096
Desc: The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not
disable external entities, which might allow remote attackers to conduct XML
external entity (XXE) attacks via a crafted PDF.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-9096
Severity: HIGH
CVE-2022-24196
Desc: iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to
contain an out-of-memory error via the component readStreamBytesRaw, which
allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-24196
Severity: MEDIUM
CVE-2022-24197
Desc: iText v7.1.17 was discovered to contain a stack-based buffer overflow via
the component ByteBuffer.append, which allows attackers to cause a Denial of
Service (DoS) via a crafted PDF file.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-24197
Severity: MEDIUM

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено…
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230501/38fe0510/attachment.html>