PublicDateAtUSN: 2017-08-27
Candidate: CVE-2017-12595
PublicDate: 2017-08-27 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12595
 https://ubuntu.com/security/notices/USN-3638-1
Description:
 The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and
 dictionaries, which allows remote attackers to cause a denial of service
 (stack consumption and segmentation fault) or possibly have unspecified
 other impact via a PDF document with a deep data structure, as demonstrated
 by a crash in QPDFObjectHandle::parseInternal in
 libqpdf/QPDFObjectHandle.cc.
Ubuntu-Description:
Notes:
 mdeslaur> this patch breaks ABI
Bugs:
 https://github.com/qpdf/qpdf/issues/146
Priority: low
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_qpdf:
 upstream: https://github.com/qpdf/qpdf/commit/ad527a64f93dca12f6aabab2ca99ae5eb352ab4b
 upstream: https://github.com/qpdf/qpdf/commit/728dc9e6d8975eebbbc0f5b35628b57d273ffe2d
upstream_qpdf: released (7.0.0-1)
precise/esm_qpdf: DNE
trusty_qpdf: released (8.0.2-3~14.04.1)
trusty/esm_qpdf: DNE (trusty was released [8.0.2-3~14.04.1])
vivid/ubuntu-core_qpdf: DNE
xenial_qpdf: released (8.0.2-3~16.04.1)
esm-infra/xenial_qpdf: released (8.0.2-3~16.04.1)
zesty_qpdf: ignored (reached end-of-life)
artful_qpdf: not-affected (7.0.0-1)
bionic_qpdf: not-affected (7.0.0-1)
devel_qpdf: not-affected (7.0.0-1)