Denial of Service in QPDF due to Infinite Recursion and Stack Consumption (CVE-2017-9208)
Summary
CVE-2017-9208: libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to releaseResolved functions, aka qpdf-infiniteloop1. Affects qpdf across 2 version ranges.
< 7.0.0-r0
< b7302a9b727d28d59bff0f0f7d8d62ff6486aef6
Fixed in 7.0.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QPDF is an open-source command-line program and library for transforming PDF files. It provides functionality for manipulating and inspecting PDF documents. The vulnerability identified as CVE-2017-9208 affects QPDF versions 6.0.0 and earlier. This vulnerability allows remote attackers to cause a denial of service by exploiting an infinite recursion and stack consumption issue in the libqpdf.a library. The vulnerability is related to the releaseResolved functions in QPDF.
Vulnerability Detail
The vulnerability (CVE-2017-9208) in QPDF arises from a flaw in the libqpdf.a library. By crafting a malicious PDF document, remote attackers can trigger an infinite recursion and stack consumption, leading to a denial of service condition. This vulnerability can be exploited remotely, requiring no authentication or user interaction. The impact of this vulnerability is limited to a denial of service, with no direct risk of information disclosure or remote code execution.
How To Fix
Minimum fixed version
7.0.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade qpdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update QPDF to the fixed version to mitigate the risk of a denial of service attack.
Conclusion
The vulnerability (CVE-2017-9208) in QPDF exposes the software to a denial of service attack. To mitigate this risk, it is recommended to upgrade QPDF to version 7.0.0-r0 or later. This upgrade includes patches to address the infinite recursion and stack consumption issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qpdf →
FAQ
QPDF is an open-source command-line program and library for transforming PDF files. It provides functionality for manipulating and inspecting PDF documents.
The vulnerability (CVE-2017-9208) in QPDF allows remote attackers to cause a denial of service by exploiting an infinite recursion and stack consumption issue. However, there is no direct risk of information disclosure or remote code execution.
To fix this vulnerability, it is recommended to upgrade QPDF to version 7.0.0-r0 or later. This upgrade includes patches to address the infinite recursion and stack consumption issue.
No, there is no known workaround for this vulnerability. It is crucial to update QPDF to the fixed version to mitigate the risk of a denial of service attack.
Yes, this vulnerability can be exploited remotely without requiring authentication or user interaction.
Related vulnerabilities
Recent vulnerabilities recorded for qpdf.
