Skip to content
OpenAdvisories
Medium ALAS2-2023-2104 1 CVE

Moderate: qpdf security update (Amazon Linux 2)

Published Jun 21, 2023 · Updated Jun 29, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36978: QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 qpdf 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-debuginfo 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-devel 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-doc 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-libs 0:5.0.1-4.amzn2.0.2

Vulnerabilities 1

  • Unscored —
    CVE-2021-36978

    QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called fro…

    qpdf qpdf Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36978.html