A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qpdf | Aug 22, 2024 | Jul 25, 2017 |
| Debian | — | Upgrade qpdf | Jul 30, 2024 | Jul 25, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2017 |
| Suse | — | Upgrade cups-filtersUpgrade qpdfUpgrade cups-filters-cups-browsedUpgrade cups-filters-foomatic-ripUpgrade qpdf-develUpgrade libqpdf21Upgrade libqpdf18Upgrade libqpdf28Upgrade libqpdf26Upgrade cups-filters-ghostscript | Feb 20, 2018 | Jul 25, 2017 |
| Ubuntu | — | Upgrade qpdfUpgrade libqpdf21 | May 15, 2018 | Jul 25, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub