QPDF vulnerability

2024-03-2500:00:00

ubuntu.com

qpdf

memory operations

json files

denial of service

arbitrary code

ubuntu 23.10

pdf files

vulnerability

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

Confidence

Low

EPSS

Percentile

10.3%

JSON

Releases

Ubuntu 23.10

Packages

qpdf - tools for transforming and inspecting PDF files

Details

It was discovered that QPDF incorrectly handled certain memory operations
when decoding JSON files. If a user or automated system were tricked into
processing a specially crafted JSON file, QPDF could be made to crash,
resulting in a denial of service, or possibly execute arbitrary code.

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchlibqpdf29< 11.5.0-1ubuntu1.1UNKNOWN
Ubuntu23.10noarchlibqpdf-dev< 11.5.0-1ubuntu1.1UNKNOWN
Ubuntu23.10noarchlibqpdf29-dbgsym< 11.5.0-1ubuntu1.1UNKNOWN
Ubuntu23.10noarchqpdf< 11.5.0-1ubuntu1.1UNKNOWN
Ubuntu23.10noarchqpdf-dbgsym< 11.5.0-1ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	23.10	noarch	libqpdf29	< 11.5.0-1ubuntu1.1	UNKNOWN
Ubuntu	23.10	noarch	libqpdf-dev	< 11.5.0-1ubuntu1.1	UNKNOWN
Ubuntu	23.10	noarch	libqpdf29-dbgsym	< 11.5.0-1ubuntu1.1	UNKNOWN
Ubuntu	23.10	noarch	qpdf	< 11.5.0-1ubuntu1.1	UNKNOWN
Ubuntu	23.10	noarch	qpdf-dbgsym	< 11.5.0-1ubuntu1.1	UNKNOWN