Stack-consumption vulnerability in libqpdf in QPDF 6.0.0
Summary
CVE-2017-11626: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc afte... Affects qpdf across 2 version ranges.
< 7.0.0-r0
< b7302a9b727d28d59bff0f0f7d8d62ff6486aef6
Fixed in 7.0.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
QPDF is an open-source library and command-line tool for manipulating PDF files. It provides functionality for reading, writing, and editing PDF documents. The vulnerability affects version 6.0.0 of the library and is related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc. This function can enter an infinite loop after four consecutive calls to QPDFObjectHandle::parseInternal, leading to a stack-consumption issue.
Vulnerability Detail
The stack-consumption vulnerability in libqpdf allows attackers to cause a denial of service by exploiting a crafted file. By triggering the infinite loop in the QPDFTokenizer::resolveLiteral function, an attacker can exhaust the stack, resulting in the application becoming unresponsive or crashing. This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
7.0.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade qpdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to update to a patched version of the qpdf package.
Conclusion
In conclusion, the stack-consumption vulnerability in libqpdf can lead to a denial of service if exploited by an attacker. It is crucial to update to a patched version of the qpdf package to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for qpdf →
FAQ
QPDF is an open-source library and command-line tool for manipulating PDF files. It provides functionality for reading, writing, and editing PDF documents.
The vulnerability allows attackers to cause a denial of service by exploiting a crafted file. This can result in the application becoming unresponsive or crashing.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
To fix this vulnerability, update to version 7.0.0-r0 or later of the qpdf package.
There is no specific workaround provided for this vulnerability. The recommended approach is to update to a patched version of the qpdf package.
Related vulnerabilities
Recent vulnerabilities recorded for qpdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
