CVE-2021-36978: Buffer Overflow
Published Jul 20, 2021
·Updated
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write (called from PlAESPDF::flush and PlAESPDF::finish) when a certain downstream write fails.
Affected Software
2 affected components
Qpdf Project Qpdf>=9.0.0<=9.1.1
Qpdf Project Qpdf>=10.0.0<=10.0.4
Remediation
Patch Available
Event History
Jul 20, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-36978?
CVE-2021-36978 is classified as a critical vulnerability due to its potential for a heap-based buffer overflow.
2
How do I fix CVE-2021-36978?
To fix CVE-2021-36978, update QPDF to version 9.1.2 or later, or 10.0.5 or later.
3
What versions of QPDF are affected by CVE-2021-36978?
CVE-2021-36978 affects QPDF versions 9.x through 9.1.1 and 10.x through 10.0.4.
4
What types of attacks could exploit CVE-2021-36978?
CVE-2021-36978 could be exploited through specially crafted PDF files that trigger buffer overflow conditions.
5
Is CVE-2021-36978 related to any specific functionality in QPDF?
CVE-2021-36978 involves a vulnerability in the Pl_ASCII85Decoder and its interaction with heap memory management.