QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qpdfUpgrade qpdf-debuginfoUpgrade qpdf-develUpgrade qpdf-libsUpgrade qpdf-doc | Jul 4, 2023 | Jul 20, 2021 |
| Debian | — | Upgrade qpdf | Aug 31, 2023 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade app-text/qpdf. | Jan 16, 2024 | Jul 20, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 20, 2021 |
| Suse | — | Upgrade qpdfUpgrade qpdf-develUpgrade libqpdf26Upgrade libqpdf21Upgrade libqpdf18 | Oct 26, 2022 | Jul 20, 2021 |
| Ubuntu | — | Upgrade qpdf (Ubuntu Pro)Upgrade qpdfUpgrade libqpdf21Upgrade libqpdf21 (Ubuntu Pro)Upgrade libqpdf26 | Jul 30, 2021 | Jul 20, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub