Home

CVE-2021-36978

Description

QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.

Risk Information

Base Score
5.5
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.079

Associated Vulnerability

VulnerabilityOS Platform
tools for transforming and inspecting PDF files (USN-5026-1) qpdf_8.0.2-3ubuntu0.1_i386.debLinux
tools for transforming and inspecting PDF files (USN-5026-1) qpdf_8.0.2-3ubuntu0.1_amd64.debLinux
tools for transforming and inspecting PDF files (USN-5026-1) qpdf_9.1.1-1ubuntu0.1_amd64.debLinux
tools for transforming and inspecting PDF files (USN-5026-1) libqpdf21_8.0.2-3ubuntu0.1_i386.debLinux
tools for transforming and inspecting PDF files (USN-5026-1) libqpdf21_8.0.2-3ubuntu0.1_amd64.debLinux
tools for transforming and inspecting PDF files (USN-5026-1) libqpdf26_9.1.1-1ubuntu0.1_amd64.debLinux
SUSE-SU-2022:2669-1(SUSE Linux Enterprise Server 12-SP5 ) libqpdf18-7.1.1-3.8.1.x86_64.rpmLinux
SUSE-SU-2022:2669-1(SUSE Linux Enterprise Server 12-SP5 ) libqpdf18-debuginfo-7.1.1-3.8.1.x86_64.rpmLinux
SUSE-SU-2022:2669-1(SUSE Linux Enterprise Server 12-SP5 ) qpdf-7.1.1-3.8.1.x86_64.rpmLinux
SUSE-SU-2022:2669-1(SUSE Linux Enterprise Server 12-SP5 ) qpdf-debuginfo-7.1.1-3.8.1.x86_64.rpmLinux
SUSE-SU-2022:2669-1(SUSE Linux Enterprise Server 12-SP5 ) qpdf-debugsource-7.1.1-3.8.1.x86_64.rpmLinux
SUSE-SU-2022:3248-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libqpdf26-9.0.2-150200.3.3.1.x86_64_15_SP3.rpmLinux
qpdf Security Update (ALAS-2024-2409) qpdf-5.0.1-4.amzn2.0.2.x86_64.rpmLinux
qpdf Security Update (ALAS-2024-2409) qpdf-doc-5.0.1-4.amzn2.0.2.noarch.rpmLinux
qpdf Security Update (ALAS-2024-2409) qpdf-libs-5.0.1-4.amzn2.0.2.i686.rpmLinux
qpdf Security Update (ALAS-2024-2409) qpdf-libs-5.0.1-4.amzn2.0.2.x86_64.rpmLinux
qpdf Security Update (ALAS-2024-2409) qpdf-devel-5.0.1-4.amzn2.0.2.x86_64.rpmLinux
qpdf Security Update (ALAS2-2024-2409) qpdf-5.0.1-4.amzn2.0.2.x86_64.rpmLinux
qpdf Security Update (ALAS2-2024-2409) qpdf-devel-5.0.1-4.amzn2.0.2.x86_64.rpmLinux
qpdf Security Update (ALAS2-2024-2409) qpdf-doc-5.0.1-4.amzn2.0.2.noarch.rpmLinux
qpdf Security Update (ALAS2-2024-2409) qpdf-libs-5.0.1-4.amzn2.0.2.i686.rpmLinux
qpdf Security Update (ALAS2-2024-2409) qpdf-libs-5.0.1-4.amzn2.0.2.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234