CVE-2017-18186: Medium severity Qpdf Project Qpdf vulnerability
Published Feb 13, 2018
·Updated
An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.
Affected Software
2 affected componentsFixes available
Qpdf Project Qpdf<7.0.0
debian/qpdf
10.1.0-111.3.0-1+deb12u112.2.0-112.3.2-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qpdfto a version that resolves this vulnerability.Fixed in 10.1.0-1Fixed in 11.3.0-1+deb12u1Fixed in 12.2.0-1Fixed in 12.3.2-1 - Upgrade
Upgrade
qpdfto a version that resolves this vulnerability.Fixed in 7.0.0
Event History
Feb 13, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:29 PM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:35 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·12:22 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·12:23 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-18186?
CVE-2017-18186 has a high severity due to the potential for denial of service caused by an infinite loop.
2
How do I fix CVE-2017-18186?
To fix CVE-2017-18186, upgrade QPDF to version 7.0.0 or later.
3
Which software versions are affected by CVE-2017-18186?
QPDF versions prior to 7.0.0 are affected by CVE-2017-18186.
4
Is there a specific patch for CVE-2017-18186?
There is no specific patch; users must upgrade to a non-vulnerable version of QPDF.
5
What is the nature of the vulnerability described in CVE-2017-18186?
CVE-2017-18186 is caused by an infinite loop due to looping xref tables in the QPDF library.