Vulnerability-Lookup

usn-3638-1

Vulnerability from osv_ubuntu

Published

2018-05-07 16:29

Modified

2026-04-22 07:36

Summary

qpdf vulnerabilities

Details

It was discovered that QPDF incorrectly handled certain malformed files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code.

References

URL

Type

	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://ubuntu.com/security/CVE-2015-9252	REPORT
	https://ubuntu.com/security/CVE-2017-9208	REPORT
	https://ubuntu.com/security/CVE-2017-9209	REPORT
	https://ubuntu.com/security/CVE-2017-9210	REPORT
	https://ubuntu.com/security/CVE-2017-11624	REPORT
	https://ubuntu.com/security/CVE-2017-11625	REPORT
	https://ubuntu.com/security/CVE-2017-11626	REPORT
	https://ubuntu.com/security/CVE-2017-11627	REPORT
	https://ubuntu.com/security/CVE-2017-12595	REPORT
	https://ubuntu.com/security/CVE-2017-18183	REPORT
	https://ubuntu.com/security/CVE-2017-18184	REPORT
	https://ubuntu.com/security/CVE-2017-18185	REPORT
	https://ubuntu.com/security/CVE-2017-18186	REPORT
	https://ubuntu.com/security/CVE-2018-9918	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-9252",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-9208",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-9209",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-9210",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11624",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11625",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11626",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11627",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-12595",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18183",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18184",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18185",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18186",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-9918",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-9252",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-9208",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-9209",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-9210",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11624",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11625",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11626",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-11627",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-12595",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18183",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18184",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18185",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18186",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-9918",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that QPDF incorrectly handled certain malformed files. A\nremote attacker could use this issue to cause QPDF to crash, resulting in a\ndenial of service, or possibly execute arbitrary code.\n",
  "id": "USN-3638-1",
  "modified": "2026-04-22T07:36:35Z",
  "published": "2018-05-07T16:29:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-9252"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-9208"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-9209"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-9210"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11624"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11625"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11626"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11627"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-12595"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18183"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18184"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18185"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18186"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-9918"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "qpdf vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2015-9252",
    "UBUNTU-CVE-2017-9208",
    "UBUNTU-CVE-2017-9209",
    "UBUNTU-CVE-2017-9210",
    "UBUNTU-CVE-2017-11624",
    "UBUNTU-CVE-2017-11625",
    "UBUNTU-CVE-2017-11626",
    "UBUNTU-CVE-2017-11627",
    "UBUNTU-CVE-2017-12595",
    "UBUNTU-CVE-2017-18183",
    "UBUNTU-CVE-2017-18184",
    "UBUNTU-CVE-2017-18185",
    "UBUNTU-CVE-2017-18186",
    "UBUNTU-CVE-2018-9918"
  ]
}

ubuntu-cve-2015-9252

Vulnerability from osv_ubuntu

Published

2018-02-13 00:00

Modified

2026-04-22 07:37

Summary

Details

An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2015-9252	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2015-9252	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.",
  "id": "UBUNTU-CVE-2015-9252",
  "modified": "2026-04-22T07:37:53Z",
  "published": "2018-02-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-9252"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-9252"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2015-9252"
  ]
}

ubuntu-cve-2017-11624

Vulnerability from osv_ubuntu

Published

2017-07-25 00:00

Modified

2026-04-22 07:38

Summary

Details

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2017-11624	REPORT
	http://somevulnsofadlab.blogspot.jp/2017/07/qpdfa…	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-11624	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an \"infinite loop.\"",
  "id": "UBUNTU-CVE-2017-11624",
  "modified": "2026-04-22T07:38:18Z",
  "published": "2017-07-25T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11624"
    },
    {
      "type": "REPORT",
      "url": "http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-11624"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-11624"
  ]
}

ubuntu-cve-2017-11625

Vulnerability from osv_ubuntu

Published

2017-07-25 00:00

Modified

2026-04-22 07:38

Summary

Details

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2017-11625	REPORT
	http://somevulnsofadlab.blogspot.jp/2017/07/qpdfa…	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-11625	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an \"infinite loop.\"",
  "id": "UBUNTU-CVE-2017-11625",
  "modified": "2026-04-22T07:38:18Z",
  "published": "2017-07-25T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11625"
    },
    {
      "type": "REPORT",
      "url": "http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_26.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-11625"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-11625"
  ]
}

ubuntu-cve-2017-11626

Vulnerability from osv_ubuntu

Published

2017-07-25 00:00

Modified

2026-04-22 07:38

Summary

Details

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2017-11626	REPORT
	http://somevulnsofadlab.blogspot.jp/2017/07/qpdfa…	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-11626	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an \"infinite loop.\"",
  "id": "UBUNTU-CVE-2017-11626",
  "modified": "2026-04-22T07:38:18Z",
  "published": "2017-07-25T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11626"
    },
    {
      "type": "REPORT",
      "url": "http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_65.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-11626"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-11626"
  ]
}

ubuntu-cve-2017-11627

Vulnerability from osv_ubuntu

Published

2017-07-25 00:00

Modified

2026-04-22 07:38

Summary

Details

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop."

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2017-11627	REPORT
	http://somevulnsofadlab.blogspot.jp/2017/07/qpdfa…	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-11627	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an \"infinite loop.\"",
  "id": "UBUNTU-CVE-2017-11627",
  "modified": "2026-04-22T07:38:18Z",
  "published": "2017-07-25T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11627"
    },
    {
      "type": "REPORT",
      "url": "http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_21.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-11627"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-11627"
  ]
}

ubuntu-cve-2017-12595

Vulnerability from osv_ubuntu

Published

2017-08-27 00:00

Modified

2026-04-22 07:38

Summary

Details

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-12595	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-12595	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.",
  "id": "UBUNTU-CVE-2017-12595",
  "modified": "2026-04-22T07:38:19Z",
  "published": "2017-08-27T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-12595"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-12595"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-12595"
  ]
}

ubuntu-cve-2017-18183

Vulnerability from osv_ubuntu

Published

2018-02-13 00:00

Modified

2026-04-22 07:38

Summary

Details

An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-18183	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-18183	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc.",
  "id": "UBUNTU-CVE-2017-18183",
  "modified": "2026-04-22T07:38:26Z",
  "published": "2018-02-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18183"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18183"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-18183"
  ]
}

ubuntu-cve-2017-18184

Vulnerability from osv_ubuntu

Published

2018-02-13 00:00

Modified

2026-04-22 07:38

Summary

Details

An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-18184	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-18184	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.",
  "id": "UBUNTU-CVE-2017-18184",
  "modified": "2026-04-22T07:38:26Z",
  "published": "2018-02-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18184"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18184"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-18184"
  ]
}

ubuntu-cve-2017-18185

Vulnerability from osv_ubuntu

Published

2018-02-13 00:00

Modified

2026-04-22 07:38

Summary

Details

An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-18185	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-18185	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.",
  "id": "UBUNTU-CVE-2017-18185",
  "modified": "2026-04-22T07:38:26Z",
  "published": "2018-02-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18185"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18185"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-18185"
  ]
}

ubuntu-cve-2017-18186

Vulnerability from osv_ubuntu

Published

2018-02-13 00:00

Modified

2026-04-22 07:38

Summary

Details

An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-18186	REPORT
	https://ubuntu.com/security/notices/USN-3638-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-18186	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~14.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-2",
        "5.0.1-1",
        "5.0.1-1ubuntu1",
        "5.1.0-1",
        "5.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libqpdf21",
            "binary_version": "8.0.2-3~16.04.1"
          },
          {
            "binary_name": "qpdf",
            "binary_version": "8.0.2-3~16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qpdf",
        "purl": "pkg:deb/ubuntu/qpdf@8.0.2-3~16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2-3~16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.3-2",
        "5.1.3-3",
        "5.2.0-1",
        "5.2.0-2",
        "6.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.",
  "id": "UBUNTU-CVE-2017-18186",
  "modified": "2026-04-22T07:38:26Z",
  "published": "2018-02-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18186"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3638-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18186"
    }
  ],
  "related": [
    "USN-3638-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-18186"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature