CVE-2017-11625
Ubuntu Security Notice USN-3638-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."
Se ha detectado una vulnerabilidad de consumo de pila en libqpdf en QPDF 6.0.0, lo que permite que los atacantes provoquen una denegación de servicio (DoS) mediante un archivo manipulado. Esto está relacionado con la función QPDF::resolveObjectsInStream en QPDF.cc. Esto también se conoce como \"infinite loop.\"" }
It was discovered that QPDF incorrectly handled certain malformed files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-07-25 CVE Reserved
- 2017-07-25 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_26.html | 2024-08-05 | |
| https://github.com/qpdf/qpdf/issues/120 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://usn.ubuntu.com/3638-1 | 2019-10-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Qpdf Project Search vendor "Qpdf Project" | Qpdf Search vendor "Qpdf Project" for product "Qpdf" | 6.0.0 Search vendor "Qpdf Project" for product "Qpdf" and version "6.0.0" | - |
Affected
| ||||||