CVE-2021-27906

Published: Mar 19, 2021Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

Affected (42)

Products: Apache: Pdfbox · Fedoraproject: Fedora · Oracle: Banking Corporate Lending Process Management, Banking Credit Facilities Process Management, Banking Supply Chain Finance, Banking Trade Finance Process Management, Banking Treasury Management, Banking Virtual Account Management, Communications Messaging Server, Communications Session Report Manager, Flexcube Universal Banking, Hyperion Financial Reporting, Hyperion Infrastructure Technology, Outside In Technology, Peoplesoft Enterprise Peopletools, Primavera Unifier, Retail Customer Management And Segmentation Foundation, Retail Xstore Point Of Service, Webcenter Sites

1 product

1 product

17 products

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Supply Chain Finance

Banking Trade Finance Process Management

Banking Treasury Management

Banking Virtual Account Management

Communications Messaging Server

Communications Session Report Manager

Flexcube Universal Banking

Hyperion Financial Reporting

Hyperion Infrastructure Technology

Outside In Technology

Peoplesoft Enterprise Peopletools

Primavera Unifier

Retail Customer Management And Segmentation Foundation

Retail Xstore Point Of Service

Webcenter Sites

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Pdfbox	From 2.0.0 to 2.0.22

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration C

38 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Corporate Lending Process Management	Version 14.2.0
Oracle Banking Corporate Lending Process Management	Version 14.3.0
Oracle Banking Corporate Lending Process Management	Version 14.5.0
Oracle Banking Credit Facilities Process Management	Version 14.2.0
Oracle Banking Credit Facilities Process Management	Version 14.3.0
Oracle Banking Credit Facilities Process Management	Version 14.5.0
Oracle Banking Supply Chain Finance	Version 14.2.0
Oracle Banking Supply Chain Finance	Version 14.3.0
Oracle Banking Supply Chain Finance	Version 14.5.0
Oracle Banking Trade Finance Process Management	Version 14.2.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.5.0
Oracle Banking Treasury Management	Version 14.5
Oracle Banking Virtual Account Management	Version 14.2.0
Oracle Banking Virtual Account Management	Version 14.3.0
Oracle Banking Virtual Account Management	Version 14.5.0
Oracle Communications Messaging Server	Version 8.1
Oracle Communications Session Report Manager	From 8.0.0 to 8.2.4.0
Oracle Flexcube Universal Banking	From 14.0.0 to 14.3.0
Oracle Flexcube Universal Banking	Version 14.5.0
Oracle Hyperion Financial Reporting	Version 11.1.2.4
Oracle Hyperion Financial Reporting	Version 11.2.6.0
Oracle Hyperion Infrastructure Technology	Before 11.2.8.0
Oracle Outside In Technology	Version 8.5.5
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2
Oracle Retail Xstore Point Of Service	Version 20.0.1
Oracle Webcenter Sites	Version 12.2.1.3.0
Oracle Webcenter Sites	Version 12.2.1.4.0

Related CWEs

CWE-789

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (48)

http://www.openwall.com/lists/oss-security/2021/03/19/10

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r64982b768c8a2220b07aaf813bd099a9863de0d13eb212fd4efe208f%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9ffe179385637b0b5cbdabd0246118005b4b8232909d2d14cd68ccd3%40%3Ccommits.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raa35746227f3f8d50fff1db9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rc69140d894c6a9c67a8097a25656cce59b46a5620c354ceba10543c3%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rdf78aef4793362e778e21e34328b0456e302bde4b7e74f229df0ee04%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/re1e35881482e07dc2be6058d9b44483457f36133cac67956686ad9b9%40%3Cnotifications.ofbiz.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AVLKAHFMPH72TTP25INPZPGX5FODK3H/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KDA2U4KL2N3XT3PM4ZJEBBA6JJIH2G4/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/

Source: security@apache.org

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/03/19/10