A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qpdf | Aug 22, 2024 | Jul 25, 2017 |
| Debian | — | Upgrade qpdf | Jul 30, 2024 | Jul 25, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 25, 2017 |
| Suse | — | Upgrade cups-filters-cups-browsedUpgrade qpdf-develUpgrade libqpdf26Upgrade libqpdf18Upgrade libqpdf21Upgrade qpdfUpgrade libqpdf28Upgrade cups-filters-ghostscriptUpgrade cups-filtersUpgrade cups-filters-foomatic-rip | Feb 20, 2018 | Jul 25, 2017 |
| Ubuntu | — | Upgrade libqpdf21Upgrade qpdf | May 15, 2018 | Jul 25, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub