PT-2017-12596 · Qpdf+3 · Qpdf+3

Jay Berkenbilt · Published 2017-08-27 · Updated 2024-06-15 · CVE-2017-12595

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QPDF versions 6.0.0 through 7.0.b1

Description The issue is related to the tokenizer in QPDF, which is recursive for arrays and dictionaries. This allows remote attackers to cause a denial of service, resulting in stack consumption and a segmentation fault, or possibly have other unspecified impacts. The attack can be carried out via a PDF document with a deep data structure.

Recommendations For QPDF versions 6.0.0 through 7.0.b1, consider restricting the parsing of deeply nested PDF structures to prevent potential denial of service attacks until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2228

CVE-2017-12595

MGASA-2018-0145

OPENSUSE-SU-2024:11289-1

SUSE-SU-2018:3066-1

SUSE-SU-2018:3066-2

USN-3638-1

Affected Products

Alt Linux

Qpdf

Suse

Ubuntu

References · 53

• https://github.com/qpdf/qpdf/commit/ad527a64f93dca12f6aabab2ca99ae5eb352ab4b · Patch
• https://github.com/qpdf/qpdf/issues/146 · Patch
• https://ubuntu.com/security/CVE-2017-12595 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9208 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11625 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-12595 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3066-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3638-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9209 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12595 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18184 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-9252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-9918 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11289-1 · Vendor Advisory