Apryse iText 8.0.1 Reference Table Handler Memory Leak: CVE-2023-6299 November 2023

Apryse iText Reference Table PdfDocument.java memory leak
A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file PdfDocument.java of the component Reference Table Handler. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.0.2 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246125 was assigned to this vulnerability. NOTE: The vendor was contacted early about this vulnerability. The fix was introduced in the iText 8.0.2 release on October 25th 2023, prior to the disclosure.

Timeline

2023-11-26

Advisory disclosed

2023-11-26

VulDB entry created

2023-11-29

VulDB entry last update 3 days later.

Weakness Type

What is a Memory Leak Vulnerability?

The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions. In some languages, developers are responsible for tracking memory allocation and releasing the memory. If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.

CVE-2023-6299 has been classified to as a Memory Leak vulnerability or weakness.

Products Associated with CVE-2023-6299

Want to know whenever a new CVE is published for Itextpdf Itext? stack.watch will email you.

Affected Versions

Exploit Probability

EPSS

0.06%

Percentile

19.71%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.