Summary
It was discovered that QPDF incorrectly handled certain malformed files. A
remote attacker could use this issue to cause QPDF to crash, resulting in a
denial of service, or possibly execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | qpdf | 8.0.2-3~14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | qpdf | 8.0.2-3~16.04.1 |
Vulnerabilities 14
-
Unscored —
An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLitera…
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause…
-
Unscored —
An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in …
-
Unscored —
An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in …
-
Unscored —
An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write fu…
-
Unscored —
An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.
-
Unscored —
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption)…
-
Unscored —
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption)…
-
Unscored —
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption)…
-
Unscored —
libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing …
References
-
report
https://ubuntu.com/security/CVE-2015-9252
-
report
https://ubuntu.com/security/CVE-2017-9208
-
report
https://ubuntu.com/security/CVE-2017-9209
-
report
https://ubuntu.com/security/CVE-2017-9210
-
report
https://ubuntu.com/security/CVE-2017-11624
-
report
https://ubuntu.com/security/CVE-2017-11625
-
report
https://ubuntu.com/security/CVE-2017-11626
-
report
https://ubuntu.com/security/CVE-2017-11627
-
report
https://ubuntu.com/security/CVE-2017-12595
-
report
https://ubuntu.com/security/CVE-2017-18183
-
report
https://ubuntu.com/security/CVE-2017-18184
-
report
https://ubuntu.com/security/CVE-2017-18185
-
report
https://ubuntu.com/security/CVE-2017-18186
-
report
https://ubuntu.com/security/CVE-2018-9918