A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qpdf | Aug 22, 2024 | Jul 25, 2017 |
| Debian | — | Upgrade qpdf | Jul 30, 2024 | Jul 25, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2017 |
| Suse | — | Upgrade cups-filters-cups-browsedUpgrade libqpdf26Upgrade libqpdf18Upgrade libqpdf21Upgrade qpdf-develUpgrade libqpdf28Upgrade cups-filters-ghostscriptUpgrade cups-filters-foomatic-ripUpgrade qpdfUpgrade cups-filters | Feb 20, 2018 | Jul 25, 2017 |
| Ubuntu | — | Upgrade qpdfUpgrade libqpdf21 | May 15, 2018 | Jul 25, 2017 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub