CVE-2017-12595

Published: 27 August 2017

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.

Priority

Low

CVSS 3 base score: 7.8

Status

Package Release Status
qpdf
Launchpad, Ubuntu, Debian
Upstream
Released (7.0.0-1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(7.0.0-1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (8.0.2-3~16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [8.0.2-3~14.04.1])
Patches:
Upstream: https://github.com/qpdf/qpdf/commit/ad527a64f93dca12f6aabab2ca99ae5eb352ab4b
Upstream: https://github.com/qpdf/qpdf/commit/728dc9e6d8975eebbbc0f5b35628b57d273ffe2d