Stack-consumption vulnerability in qpdf
Summary
CVE-2017-11624: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc afte... Affects qpdf across 2 version ranges.
< 7.0.0-r0
< b7302a9b727d28d59bff0f0f7d8d62ff6486aef6
Fixed in 7.0.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QPDF is an open-source command-line program and library for manipulating PDF files. It provides functionality for reading, writing, and editing PDF documents. The vulnerability in question affects versions 6.0.0 and earlier of the library. The vulnerability allows attackers to cause a denial of service by exploiting a stack-consumption issue in the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc. This occurs after two consecutive calls to QPDFObjectHandle::parseInternal, resulting in an infinite loop.
Vulnerability Detail
The stack-consumption vulnerability in QPDF can be exploited by an attacker through a crafted file. By leveraging the QPDFTokenizer::resolveLiteral function and the behavior of QPDFObjectHandle::parseInternal, an attacker can trigger an infinite loop, leading to a denial of service. This vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity level. The impact of this vulnerability is limited to a denial of service, and there is no risk of arbitrary code execution or information disclosure.
How To Fix
Minimum fixed version
7.0.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade qpdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the qpdf package as soon as possible.
Conclusion
In conclusion, the stack-consumption vulnerability in qpdf can be exploited by attackers to cause a denial of service. To mitigate this vulnerability, users should update to version 7.0.0-r0 or later of the qpdf package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qpdf →
FAQ
QPDF is an open-source command-line program and library for manipulating PDF files. It provides functionality for reading, writing, and editing PDF documents.
The vulnerability allows attackers to cause a denial of service by exploiting a stack-consumption issue in the QPDF library. However, there is no risk of arbitrary code execution or information disclosure.
To fix this vulnerability, it is recommended to update to version 7.0.0-r0 or later of the qpdf package.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the qpdf package as soon as possible.
The CVSSv3 score of this vulnerability is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for qpdf.
