A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-qpdf | Aug 22, 2024 | Jul 25, 2017 | |
| Debian | debian-upgrade-qpdf | Jul 30, 2024 | Jul 25, 2017 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jul 25, 2017 | |
| Suse | — | suse-upgrade-cups-filterssuse-upgrade-cups-filters-cups-browsedsuse-upgrade-cups-filters-foomatic-ripsuse-upgrade-cups-filters-ghostscriptsuse-upgrade-libqpdf18suse-upgrade-libqpdf21suse-upgrade-libqpdf26suse-upgrade-libqpdf28suse-upgrade-qpdfsuse-upgrade-qpdf-devel | Feb 20, 2018 | Jul 25, 2017 |
| Ubuntu | ubuntu-upgrade-libqpdf21ubuntu-upgrade-qpdf | May 15, 2018 | Jul 25, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub