CVE-2024-24246

CVE-2024-24246 is a heap buffer overflow in qpdf 11.9.0 triggered by memory handling in the standard library’s shared_ptr path (std::__shared_count). Multiple connected reports (Ubuntu, Fedora, Red Hat, OpenVAS, and Nessus plugins) describe that processing certain input can crash the application,...

CVE-2017-11624

CVE-2017-11624 is a stack‑consumption DoS in libqpdf (QPDF) 6.0.0 caused by the QPDFTokenizer::resolveLiteral path after two consecutive QPDFObjectHandle::parseInternal calls, leading to an infinite loop. Public details describe a crafted PDF triggering DoS with potential impact on availability. ...

CVE-2017-9208

CVE-2017-9208 is a vulnerability in libqpdf.a of QPDF 6.0.0 where a crafted PDF can trigger infinite recursion and stack consumption, causing a denial of service. The issue is linked to the releaseResolved functions, i.e., qpdf-infiniteloop1, and is discussed alongside related CVEs (CVE-2017-9209...

CVE-2017-11626

CVE-2017-11626 affects libqpdf (QPDF 6.0.0) with a stack-consumption vulnerability in QPDFTokenizer::resolveLiteral() that can lead to denial of service via a crafted PDF. The issue stems from an infinite loop after parsing internal objects, potentially causing high CPU/stack usage. The related o...

CVE-2017-12595

The CVE-2017-12595 entry concerns QPDF (libqpdf) 6.0.0 and 7.0.b1, where the tokenizer is recursive for arrays and dictionaries. This can be triggered by a crafted PDF with a deep data structure, causing stack consumption and a segmentation fault in QPDFObjectHandle::parseInternal, i.e., a denial...

CVE-2017-11627

CVE-2017-11627 is a stack-consumption vulnerability in libqpdf (QPDF 6.0.0) that allows DoS via a crafted PDF, related to the PointerHolder.hh code and described as an infinite loop. Affected component: libqpdf.a within QPDF 6.0.0. Impact as stated: denial of service with potential stack consumpt...

CVE-2021-36978

Summary: CVE-2021-36978 affects QPDF versions 9.x up to 9.1.1 and 10.x up to 10.0.4, due to a heap-based buffer overflow in Pl_ASCII85Decoder::write (invoked via Pl_AES_PDF::flush/finish) when a downstream write fails. This can enable arbitrary code execution or, per reports, cause crashes or ins...

CVE-2017-9209

CVE-2017-9209 affects libqpdf.a in QPDF 6.0.0, enabling denial of service via crafted PDF and a call path involving QPDFObjectHandle::parseInternal (qpdf-infiniteloop2). Connected advisories (EulerOS, OpenVAS, Nessus) corroborate that the vulnerability stems from infinite recursion/stack consumpt...

CVE-2017-11625

CVE-2017-11625 is a stack-consumption DoS in libqpdf (QPDF 6.0.0) triggered by processing crafted PDF documents. The issue is tied to the internal path QPDF.cc:QPDF::resolveObjectsInStream, causing an infinite loop/stack growth. Several advisories (including SUSE updates to 7.1.1) document this f...

CVE-2017-9210

CVE-2017-9210 affects libqpdf.a in QPDF 6.0.0, allowing remote attackers to cause a denial of service via a crafted PDF, via the unparse functions (qpdf-infiniteloop3). The issue is due to an infinite recursion/stack consumption in QPDF when parsing crafted documents. Connected sources (EulerOS/N...

CVE-2022-34503

CVE-2022-34503 affects QPDF v8.4.2, where a heap buffer overflow in QPDF::processXRefStream enables DoS via crafted PDFs. Connected docs confirm the vulnerability and associated advisories (including Astra Linux, EUVD, OSV entries) but do not provide an explicit patched version in the supplied ma...

CVE-2015-9252

CVE-2015-9252 concerns QPDF before 7.0.0. The issue is an endless recursion in QPDFTokenizer::resolveLiteral() related to the QPDF::resolve function in QPDF.cc, causing stack exhaustion (denial of service). Affected component is the QPDF library used by various packages; no patch/version fix deta...

CVE-2017-18186

CVE-2017-18186 affects QPDF before 7.0.0. The issue is an infinite loop caused by looping xref tables in QPDF.cc, as described in multiple sources (e.g., SUSE/RHEL/NASL entries). The CVE entry lists CVSS metrics: CVSSv2 base 4.3 (MEDIUM) with network attack vector and partial availability impact;...

CVE-2017-18183

CVE-2017-18183 affects the QPDF project (libqpdf). Affected version: before 7.0.0. The issue is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc. The connected sources confirm this exact root cause and location. The documents do not provide exploitation detail...

CVE-2018-9918

CVE-2018-9918 affects libqpdf.a in QPDF up to version 8.0.2, where nesting in direct objects is not properly restricted. This mishandling of certain "expected dictionary key but found non-name object" cases can allow remote attackers to cause a denial of service via stack exhaustion. Connected ad...

CVE-2017-18185

CVE-2017-18185 affects QPDF before 7.0.0. The issue is a large heap-based out-of-bounds read in Pl_Buffer::write, caused by an integer overflow in the PNG filter. Several connected advisories/documentation (e.g., SUSE, Red Hat, Ubuntu, NVD) corroborate the vulnerability and reference a qpdf commi...

CVE-2021-25786

CVE-2021-25786 affects QPDF 10.0.4, where a crafted PDF can trigger remote code execution via Pl_ASCII85Decoder::write in libqpdf. Multiple connected advisories (Debian DLA-3548, Red Hat unpatched advisories, and Amazon ALAS-2024-2409) corroborate the issue and indicate downstream fixes/upgrades ...

CVE-2017-18184

CVE-2017-18184 affects QPDF prior to 7.0.0. The vulnerability is a stack-based out-of-bounds read in the function iterate_rc4 within QPDF_encryption.cc, as disclosed in multiple sources. The published details do not specify affected products beyond the QPDF project, nor do they provide explicit e...

CVE-2018-18020

CVE-2018-18020 : In qpdf 8.2.1 (libqpdf/QPDFWriter.cc), recursive calls in QPDFWriter::unparseObject and QPDFWriter::unparseChild allow a remote attacker to trigger a denial of service via a crafted PDF. Connected advisories confirm this is exploitable remotely in affected qpdf deployments (e.g.,...