Recursive Tokenizer Vulnerability in qpdf
Summary
CVE-2017-12595: The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other im... Affects qpdf across 2 version ranges.
< 7.0.0-r0
< ad527a64f93dca12f6aabab2ca99ae5eb352ab4b
Fixed in 7.0.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qpdf is an open-source command-line program and library for manipulating PDF files. It provides functionality for reading, writing, and modifying PDF documents. The vulnerability affects qpdf versions 6.0.0 and 7.0.b1. The tokenizer in qpdf is recursive for arrays and dictionaries, which can be exploited by remote attackers to cause a denial of service or potentially have other unspecified impacts. This vulnerability is identified as CVE-2017-12595 and has a CVSS score of 7.8.
Vulnerability Detail
The vulnerability in qpdf arises from its recursive tokenizer for arrays and dictionaries. This allows attackers to create a PDF document with a deep data structure, leading to stack consumption and a segmentation fault. As a result, the application may crash or experience other unexpected behavior. The vulnerability is located in the QPDFObjectHandle::parseInternal function in libqpdf/QPDFObjectHandle.cc.
How To Fix
Minimum fixed version
7.0.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade qpdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating qpdf to a patched version.
Conclusion
The recursive tokenizer vulnerability in qpdf can be exploited by remote attackers to cause a denial of service or other impacts. It is crucial to update qpdf to version 7.0.0-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qpdf →
FAQ
qpdf is an open-source program and library for manipulating PDF files. It provides various functionalities for working with PDF documents.
The vulnerability affects qpdf versions 6.0.0 and 7.0.b1.
The vulnerability can lead to a denial of service, stack consumption, and segmentation fault. It may also have other unspecified impacts.
To fix this vulnerability, update qpdf to version 7.0.0-r0 or later.
No, there is no known workaround for this vulnerability. Updating to a patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for qpdf.
