CVE-2024-24246

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::sharedcount function at /bits/sharedptrbase.h...

CVE-2024-24246

CVE-2024-24246 is a heap buffer overflow in qpdf 11.9.0 triggered by memory handling in the standard library’s shared_ptr path (std::__shared_count). Multiple connected reports (Ubuntu, Fedora, Red Hat, OpenVAS, and Nessus plugins) describe that processing certain input can crash the application,...

CVE-2024-24246

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::sharedcount function at /bits/sharedptrbase.h...

CVE-2024-24246: Out-of-bounds Write

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::sharedcount function at /bits/sharedptrbase.h...

CVE-2024-24246

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::sharedcount function at /bits/sharedptrbase.h...

qpdf:tiffpredictor_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4846796006293504 Project: qpdf Fuzzing Engine: afl Fuzz Target: tiffpredictorfuzzer Job Type: aflasanqpdf Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

OSV-2024-18 Heap-use-after-free in QPDF::read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65777 Crash type: Heap-use-after-free READ 8 Crash state: QPDF::readxref QPDF::reconstructxref QPDF::parse...

PT-2024-40667

Name of the Vulnerable Software and Affected Versions: QPDF affected versions not specified Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This error is triggered in the QPDF::read xref functio...

qpdf:qpdf_fuzzer: Heap-use-after-free in QPDF::read_xref

Project: https://github.com/qpdf/qpdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4727665277861888 Project: qpdf Fuzzing Engine: libFuzzer Fuzz Target: qpdffuzzer Job Type: libfuzzerasanqpdf Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x606000000340 Crash...

GLSA-202401-20 : QPDF: Buffer Overflow

The remote host is affected by the vulnerability described in GLSA-202401-20 QPDF: Buffer Overflow - QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush and PlAESPDF::finish when a certain downstream write fails...

QPDF: Buffer Overflow

Background QPDF: A content-preserving PDF document transformer. Description A vulnerability has been discovered in QPDF. Please review the CVE identifier referenced below for details. Impact QPDF has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush and...

Important: qpdf

Issue Overview: An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf. CVE-2021-25786 QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in...

Amazon Linux 2 : qpdf (ALAS-2024-2409)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2409 advisory. 2024-01-17: CVE-2021-36978 was added to this advisory. An issue was discovered in QPDF version 10.0.4, allows remote attacker...

fileopsx (>=1.0.1, <=1.0.2), xml2pdf (>=1.0.0, <=1.1.0) potentially affected by CVE-2023-26155 via node-qpdf (1.0.3)

node-qpdf NPM version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on node-qpdf and may be impacted: - fileopsx =1.0.1, =1.0.0, =1.1.0 Source cves: CVE-2023-26155 Source advisory: OSV:GHSA-FPR8-4WVX-J9Q3...

node-qpdf vulnerable to command injection

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...

GHSA-FPR8-4WVX-J9Q3 node-qpdf vulnerable to command injection

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...

Command injection

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...

CVE-2023-26155

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...

CVE-2023-26155

node-qpdf is vulnerable to Command Injection due to encrypt() not sanitizing input before passing it to a sensitive command execution API. Affected: all versions. Root cause: unsanitized parameter input in encrypt() leads to command execution when a PDF file path is provided. Impact: potential ar...

CVE-2023-26155

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...