CVE-2017-11626: Medium severity qpdf vulnerability
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11626?
CVE-2017-11626 has a severity rating that suggests it can lead to denial of service due to stack consumption.
How do I fix CVE-2017-11626?
To fix CVE-2017-11626, update QPDF to version 8.0.2-3~14.04.1 or a later version for affected Ubuntu systems.
Which versions of QPDF are affected by CVE-2017-11626?
CVE-2017-11626 affects QPDF version 6.0.0 specifically, along with several older versions of its packages.
What type of vulnerability is CVE-2017-11626?
CVE-2017-11626 is classified as a stack-consumption vulnerability resulting from improper handling of crafted files.
What systems are impacted by CVE-2017-11626?
CVE-2017-11626 impacts systems running specific versions of the QPDF library, including those on Ubuntu and Debian builds.