CVE-2021-27807

Published: Mar 19, 2021Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Affected (31)

Products: Apache: Pdfbox · Fedoraproject: Fedora · Oracle: Banking Trade Finance Process Management, Banking Treasury Management, Banking Virtual Account Management, Communications Messaging Server, Communications Session Report Manager, Flexcube Universal Banking, Hyperion Financial Reporting, Hyperion Infrastructure Technology, Outside In Technology, Primavera Unifier, Retail Customer Management And Segmentation Foundation, Retail Xstore Point Of Service, Webcenter Sites

1 product

1 product

13 products

Banking Trade Finance Process Management

Banking Treasury Management

Banking Virtual Account Management

Communications Messaging Server

Communications Session Report Manager

Flexcube Universal Banking

Hyperion Financial Reporting

Hyperion Infrastructure Technology

Outside In Technology

Primavera Unifier

Retail Customer Management And Segmentation Foundation

Retail Xstore Point Of Service

Webcenter Sites

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Pdfbox	From 2.0.0 to 2.0.22

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration C

27 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Trade Finance Process Management	Version 14.2.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.5.0
Oracle Banking Treasury Management	Version 14.5
Oracle Banking Virtual Account Management	Version 14.2.0
Oracle Banking Virtual Account Management	Version 14.3.0
Oracle Banking Virtual Account Management	Version 14.5.0
Oracle Communications Messaging Server	Version 8.1
Oracle Communications Session Report Manager	From 8.0.0 to 8.2.4.0
Oracle Flexcube Universal Banking	From 14.0.0 to 14.3.0
Oracle Flexcube Universal Banking	Version 14.5.0
Oracle Hyperion Financial Reporting	Version 11.1.2.4
Oracle Hyperion Financial Reporting	Version 11.2.6.0
Oracle Hyperion Infrastructure Technology	Before 11.2.8.0
Oracle Outside In Technology	Version 8.5.5
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2
Oracle Retail Xstore Point Of Service	Version 20.0.1
Oracle Webcenter Sites	Version 12.2.1.3.0
Oracle Webcenter Sites	Version 12.2.1.4.0

Related CWEs

CWE-834

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

References (48)

http://www.openwall.com/lists/oss-security/2021/03/19/9

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r043edc5dcf9199f7f882ed7906b41cb816753766e88b8792dbf319a9%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4717f902f8bc36d47b3fa978552a25e4ed3ddc2fffb52b94fbc4ab36%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r9ffe179385637b0b5cbdabd0246118005b4b8232909d2d14cd68ccd3%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raa35746227f3f8d50fff1db9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rc69140d894c6a9c67a8097a25656cce59b46a5620c354ceba10543c3%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/re1e35881482e07dc2be6058d9b44483457f36133cac67956686ad9b9%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AVLKAHFMPH72TTP25INPZPGX5FODK3H/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KDA2U4KL2N3XT3PM4ZJEBBA6JJIH2G4/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/

Source: security@apache.org

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/03/19/9