Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-36464
HistoryJun 27, 2023 - 12:00 a.m.

CVE-2023-36464

2023-06-2700:00:00
ubuntu.com
ubuntu.com
20
pypdf
cve-2023-36464
fix

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

19.3%

pypdf is an open source, pure-python PDF library. In affected versions an
attacker may craft a PDF which leads to an infinite loop if
__parse_content_stream is executed. That is, for example, the case if the
user extracted text from such a PDF. This issue was introduced in pull
request #969 and resolved in pull request #1828. Users are advised to
upgrade. Users unable to upgrade may modify the line while peek not in (b"\r", b"\n") in pypdf/generic/_data_structures.py to while peek not in (b"\r", b"\n", b"").

OSVersionArchitecturePackageVersionFilename
ubuntu24.04noarchpypdf< anyUNKNOWN

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

19.3%