Vulnerability CVE-2021-36978: Information
Description
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| qpdf | sisyphus | 10.1.0-alt1 | 11.9.0-alt1 | ALT-PU-2021-1011-1 | 264481 | Fixed |
| qpdf | p10 | 10.1.0-alt1 | 10.4.0-alt1 | ALT-PU-2021-1011-1 | 264481 | Fixed |
| qpdf | p9 | 10.4.0-alt1 | 10.4.0-alt1 | ALT-PU-2023-4131-1 | 323344 | Fixed |
| qpdf | p9_e2k | 10.4.0-alt1 | 10.4.0-alt1 | ALT-PU-2023-5371-1 | - | Fixed |
| qpdf | c10f1 | 10.1.0-alt1 | 10.4.0-alt1 | ALT-PU-2021-1011-1 | 264481 | Fixed |
| qpdf | c9f2 | 10.5.0-alt1 | 10.5.0-alt1 | ALT-PU-2022-1049-1 | 292419 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28262 |
|
| https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5 |
|
| https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qpdf/OSV-2020-2245.yaml |
|
| [debian-lts-announce] 20230829 [SECURITY] [DLA 3548-1] qpdf security update | |
| https://github.com/qpdf/qpdf/issues/492 | |
| GLSA-202401-20 |