QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qpdf-debuginfoUpgrade qpdfUpgrade qpdf-libsUpgrade qpdf-docUpgrade qpdf-devel | Jul 4, 2023 | Jul 20, 2021 |
| Debian | — | Upgrade qpdf | Aug 31, 2023 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade app-text/qpdf. | Jan 16, 2024 | Jul 20, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 20, 2021 |
| Suse | — | Upgrade qpdf-develUpgrade libqpdf26Upgrade qpdfUpgrade libqpdf21Upgrade libqpdf18 | Oct 26, 2022 | Jul 20, 2021 |
| Ubuntu | — | Upgrade qpdfUpgrade qpdf (Ubuntu Pro)Upgrade libqpdf26Upgrade libqpdf21Upgrade libqpdf21 (Ubuntu Pro) | Jul 30, 2021 | Jul 20, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub