QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
References
| Link | Resource |
|---|---|
| https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28262 | Patch Third Party Advisory |
| https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qpdf/OSV-2020-2245.yaml | Third Party Advisory |
| https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5 | Patch Third Party Advisory |
| https://github.com/qpdf/qpdf/issues/492 | |
| https://lists.debian.org/debian-lts-announce/2023/08/msg00037.html | |
| https://security.gentoo.org/glsa/202401-20 |
Configurations
Configuration 1 (hide)
|
History
15 Jan 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Jul 2021, 17:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:qpdf_project:qpdf:*:*:*:*:*:*:*:* | |
| CWE | CWE-787 | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 5.5 |
| References | (MISC) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28262 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qpdf/OSV-2020-2245.yaml - Third Party Advisory | |
| References | (MISC) https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5 - Patch, Third Party Advisory |
20 Jul 2021, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-20 07:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-36978
Mitre link : CVE-2021-36978
CVE.ORG link : CVE-2021-36978
JSON object : View
Products Affected
qpdf_project
- qpdf
CWE
CWE-787
Out-of-bounds Write