CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

DEBIAN-CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

Code injection

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

UBUNTU-CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

QPDF Resource Management Error Vulnerability

QPDF is a software application. A C++ library and a set of programs that examine and manipulate the structure of PDF files. A security vulnerability exists in QPDF version 10.0.4, which stems from an arbitrary code execution vulnerability in the parameter PlASCII85Decoder::write...

CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

CVE-2021-25786

CVE-2021-25786 affects QPDF 10.0.4, where a crafted PDF can trigger remote code execution via Pl_ASCII85Decoder::write in libqpdf. Multiple connected advisories (Debian DLA-3548, Red Hat unpatched advisories, and Amazon ALAS-2024-2409) corroborate the issue and indicate downstream fixes/upgrades ...

CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to PlASCII85Decoder::write parameter in libqpdf...

Amazon Linux 2 : qpdf (ALAS-2023-2099)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2099 advisory. QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows...

Amazon Linux 2 : qpdf (ALAS-2023-2104)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2104 advisory. QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush...

fileopsx (>=1.0.1 <=1.0.2), xml2pdf (>=1.0.0 <=1.1.0) potentially affected by CVE-2023-26155 via node-qpdf (=1.0.3)

node-qpdf NPM version =1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on node-qpdf and may be impacted: - fileopsx =1.0.1, =1.0.0, =1.1.0 Source cves: CVE-2023-26155 Source advisory: SNYK:JS-NODEQPDF-5747918...

Improper Neutralization of Special Elements used in a Command

Overview node-qpdf is an A Content Preserving transformations on PDFs wrapped around QPDF Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in a Command such that the package-exported method encrypt fails to sanitize its parameter input, which...

Medium: qpdf

Issue Overview: QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted PDF file. CVE-2022-34503 Affected Packages: qpdf Note: This advisory is applicable to Amazon...

Medium: qpdf

Issue Overview: QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush and PlAESPDF::finish when a certain downstream write fails. CVE-2021-36978 Affected Packages: qpdf Note: This advisory is applicable to Amazon Lin...

SUSE CVE-2015-9252

An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc...

SUSE CVE-2017-11625

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."...

SUSE CVE-2017-11626

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite...

SUSE CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...