Stack-consumption vulnerability in libqpdf in QPDF 6.0.0
Summary
CVE-2017-11625: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infin... Affects qpdf across 2 version ranges.
< 7.0.0-r0
< b7302a9b727d28d59bff0f0f7d8d62ff6486aef6
Fixed in 7.0.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QPDF is an open-source library and command-line tool for manipulating PDF files. It provides functionality for reading, writing, and editing PDF documents. The vulnerability affects version 6.0.0 of the library, specifically the QPDF::resolveObjectsInStream function in QPDF.cc. This function is responsible for resolving objects in a PDF stream. The vulnerability allows attackers to cause a denial of service by exploiting an infinite loop in the function.
Vulnerability Detail
The stack-consumption vulnerability in libqpdf allows attackers to trigger an infinite loop, leading to a denial of service. By crafting a malicious file, an attacker can exploit the QPDF::resolveObjectsInStream function, causing it to consume excessive stack memory and crash the application. This vulnerability can be exploited remotely without authentication. The impact of this vulnerability is limited to denial of service, and it does not allow for arbitrary code execution or privilege escalation.
How To Fix
Minimum fixed version
7.0.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade qpdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the qpdf package to mitigate the risk.
Conclusion
In conclusion, the stack-consumption vulnerability in libqpdf can be exploited to cause a denial of service. It is recommended to update to the latest version of the qpdf package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qpdf →
FAQ
The vulnerability allows attackers to cause a denial of service by exploiting an infinite loop in the QPDF library. However, it does not allow for arbitrary code execution or privilege escalation.
Yes, this vulnerability can be exploited remotely without authentication.
Yes, updating to version 7.0.0-r0 or later of the qpdf package fixes the vulnerability.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of the qpdf package.
No, this vulnerability only allows for a denial of service attack and does not provide the ability to execute arbitrary code or escalate privileges.
Related vulnerabilities
Recent vulnerabilities recorded for qpdf.
