Skip to content
OpenAdvisories
Unscored USN-5026-1 2 CVEs

qpdf vulnerabilities

Published Jul 29, 2021 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that QPDF incorrectly handled certain malformed PDF
files. A remote attacker could use this issue to cause QPDF to consume
resources, resulting in a denial of service. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-18020)

It was discovered that QPDF incorrectly handled certain malformed PDF
files. A remote attacker could use this issue to cause QPDF to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2021-36978)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS qpdf 8.0.2-3ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS qpdf 9.1.1-1ubuntu0.1

Vulnerabilities 2

  • Unscored —
    CVE-2018-18020

    In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls fo…

    qpdf qpdf Debian Ubuntu
  • Unscored —
    CVE-2021-36978

    QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called fro…

    qpdf qpdf Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2018-18020
  • report
    https://ubuntu.com/security/CVE-2021-36978