CVE-2017-11624: Medium severity qpdf vulnerability
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11624?
CVE-2017-11624 has a severity rating that indicates it can lead to a denial of service due to stack consumption.
How do I fix CVE-2017-11624?
To fix CVE-2017-11624, update to QPDF version 7.0.0-1 or later as specified in the vendor's advisory.
Which versions of QPDF are affected by CVE-2017-11624?
CVE-2017-11624 affects QPDF versions before 7.0.0 and specifically version 6.0.0.
Can CVE-2017-11624 be exploited remotely?
Yes, CVE-2017-11624 can potentially be exploited remotely through crafted files that trigger the vulnerability.
What components of QPDF are involved in CVE-2017-11624?
CVE-2017-11624 involves the QPDFTokenizer::resolveLiteral function in the libqpdf library.