CVE-2017-18185

An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the PlBuffer::write function in PlBuffer.cc. It is caused by an integer overflow in the PNG filter...

UBUNTU-CVE-2017-18186

An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc...

UBUNTU-CVE-2017-18183

An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject function in libqpdf/QPDFWriter.cc...

PT-2018-6715

Name of the Vulnerable Software and Affected Versions: QPDF versions prior to 7.0.0 Description: An issue was discovered in QPDF. There is a stack-based out-of-bounds read in the function iterate rc4 in QPDF encryption.cc. Recommendations: For versions prior to 7.0.0, update to version 7.0.0 or...

PT-2018-6716

Name of the Vulnerable Software and Affected Versions: QPDF versions prior to 7.0.0 Description: An issue was discovered in QPDF, where a large heap-based out-of-bounds read occurs in the Pl Buffer::write function. This is caused by an integer overflow in the PNG filter. Recommendations: For...

PT-2018-4563

Name of the Vulnerable Software and Affected Versions QPDF versions prior to 7.0.0 Description An issue in QPDF causes endless recursion, leading to stack exhaustion in the QPDFTokenizer::resolveLiteral function, related to the QPDF::resolve function. Recommendations For versions prior to 7.0.0,...

PT-2018-6714

Name of the Vulnerable Software and Affected Versions: QPDF versions prior to 7.0.0 Description: An issue was discovered in the QPDFWriter::enqueueObject function, located in libqpdf/QPDFWriter.cc, which contains an infinite loop. Recommendations: For versions prior to 7.0.0, update to version...

PT-2018-6717

Name of the Vulnerable Software and Affected Versions: QPDF versions prior to 7.0.0 Description: An issue was discovered in QPDF due to looping xref tables in QPDF.cc, resulting in an infinite loop. Recommendations: For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issu...

QPDF Denial of Service Vulnerability (CNVD-2017-30595)

QPDF is content preserving PDF conversion system. The QPDF tokenizer implementation has a security vulnerability that allows remote attackers to exploit the vulnerability to build special PDF files that can be parsed by inducing users and can be used for denial-of-service attacks...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified...

Design/Logic Flaw

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

ALPINE-CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

CVE-2017-12595

The CVE-2017-12595 entry concerns QPDF (libqpdf) 6.0.0 and 7.0.b1, where the tokenizer is recursive for arrays and dictionaries. This can be triggered by a crafted PDF with a deep data structure, causing stack consumption and a segmentation fault in QPDFObjectHandle::parseInternal, i.e., a denial...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...

CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...