Skip to content
OpenAdvisories
Medium ALAS2-2023-2099 1 CVE

Moderate: qpdf security update (Amazon Linux 2)

Published Jun 21, 2023 · Updated Jun 29, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-34503: QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 qpdf 0:5.0.1-4.amzn2.0.1
Amazon Linux · 2 qpdf-debuginfo 0:5.0.1-4.amzn2.0.1
Amazon Linux · 2 qpdf-devel 0:5.0.1-4.amzn2.0.1
Amazon Linux · 2 qpdf-doc 0:5.0.1-4.amzn2.0.1
Amazon Linux · 2 qpdf-libs 0:5.0.1-4.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2022-34503

    QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerabili…

    qpdf qpdf Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-34503.html