Skip to content
OpenAdvisories
High ALAS2-2024-2409 2 CVEs

Important: qpdf security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 17, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36978: QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails. CVE-2021-25786: An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 qpdf 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-debuginfo 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-devel 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-doc 0:5.0.1-4.amzn2.0.2
Amazon Linux · 2 qpdf-libs 0:5.0.1-4.amzn2.0.2

Vulnerabilities 2

  • Unscored —
    CVE-2021-25786

    An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file…

    qpdf qpdf Debian Ubuntu
  • Unscored —
    CVE-2021-36978

    QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called fro…

    qpdf qpdf Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-25786.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-36978.html