CVE-2017-12595
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows...
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
CVE-2017-12595- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
CVE-2017-12595- Updated
- 2026-11-02
EUVDEUVD-2017-4166 No score
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
EUVD-2017-4166- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q7vh-x7xx-x6hx
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows...
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
GHSA-q7vh-x7xx-x6hx- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-12595
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
ALPINE-CVE-2017-12595- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
CVE-2017-12595- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2017-12595
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
DEBIAN-CVE-2017-12595- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12595
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
- Record
UBUNTU-CVE-2017-12595- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0145 No score
Updated qpdf packages fix security vulnerabilities
Updated qpdf packages fix security vulnerabilities:
- Stack overflow due to endless recursion in QPDFTokenizer::resolveLiteral()
- Another stack overflow / endless recursion in QPDFWriter::enqueueObject()
- Stack out of bounds read in iterate_rc4()
- heap out of bounds read (large) in Pl_Buffer::write
- Hang due to a pdf xref loop:
Also, the libjpeg package has been patched to provide pkgconfig files, so that cups-filters could be rebuilt against this qpdf update.
- Record
MGASA-2018-0145- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11289-1 No score
libqpdf28-10.3.2-1.3 on GA media
These are all security issues fixed in the libqpdf28-10.3.2-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11289-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3066-1 No score
Security update for qpdf
This update for qpdf fixes the following issues:
qpdf was updated to 7.1.1.
Security issues fixed:
-
CVE-2017-11627: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050577).
-
CVE-2017-11625: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050579).
-
CVE-2017-11626: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050578).
-
CVE-2017-11624: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050581).
-
CVE-2017-12595: Stack overflow when processing deeply nested arrays and dictionaries (bsc#1055960).
-
CVE-2017-9209: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040312).
-
CVE-2017-9210: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040313).
-
CVE-2017-9208: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040311).
- Check release notes for detailed bug fixes.
- http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes
- Record
SUSE-SU-2018:3066-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3066-2 No score
Security update for qpdf
This update for qpdf fixes the following issues:
qpdf was updated to 7.1.1.
Security issues fixed:
-
CVE-2017-11627: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050577).
-
CVE-2017-11625: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050579).
-
CVE-2017-11626: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050578).
-
CVE-2017-11624: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050581).
-
CVE-2017-12595: Stack overflow when processing deeply nested arrays and dictionaries (bsc#1055960).
-
CVE-2017-9209: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040312).
-
CVE-2017-9210: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040313).
-
CVE-2017-9208: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040311).
- Check release notes for detailed bug fixes.
- http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes
- Record
SUSE-SU-2018:3066-2- Updated
- 2026-11-02
OSVUSN-3638-1 No score
qpdf vulnerabilities
It was discovered that QPDF incorrectly handled certain malformed files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3638-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qpdfAlpine:v3.8 |
before 7.0.0-r0 | 7.0.0-r0 |
qpdfAlpine:v3.9 |
before 7.0.0-r0 | 7.0.0-r0 |
qpdfDebian:12 |
before 7.0.0-1 | 7.0.0-1 |
qpdfDebian:13 |
before 7.0.0-1 | 7.0.0-1 |
qpdfDebian:14 |
before 7.0.0-1 | 7.0.0-1 |
qpdfMageia:5 From an advisory covering 8 CVEs |
before 7.1.1-1.mga5 | 7.1.1-1.mga5 |
libjpegMageia:5 From an advisory covering 8 CVEs |
before 1.3.1-4.3.mga5 | 1.3.1-4.3.mga5 |
cups-filtersMageia:5 From an advisory covering 8 CVEs |
before 1.0.71-1.4.mga5 | 1.0.71-1.4.mga5 |
cups-filtersSUSE:OpenStack Cloud 7 From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:OpenStack Cloud 7 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cups-filtersSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 8 CVEs |
before 1.0.58-19.2.3 | 1.0.58-19.2.3 |
qpdfSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
qpdfSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server 12-LTSS From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Linux Enterprise Server 12-LTSS From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 8 CVEs |
before 1.0.58-19.2.3 | 1.0.58-19.2.3 |
qpdfSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 8 CVEs |
before 1.0.58-19.2.3 | 1.0.58-19.2.3 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Enterprise Storage 4 From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Enterprise Storage 4 From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
cups-filtersSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 8 CVEs |
before 1.0.58-15.2.1 | 1.0.58-15.2.1 |
qpdfSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 8 CVEs |
before 7.1.1-3.3.4 | 7.1.1-3.3.4 |
qpdfUbuntu:14.04:LTS |
before 8.0.2-3~14.04.1, plus listed versions 4.2.0-25.0.1-15.0.1-1ubuntu15.1.0-15.1.1-1 |
8.0.2-3~14.04.1 |
qpdfUbuntu:16.04:LTS |
before 8.0.2-3~16.04.1, plus listed versions 5.1.3-25.1.3-35.2.0-15.2.0-26.0.0-2 |
8.0.2-3~16.04.1 |
qpdfUbuntu:14.04:LTS From an advisory covering 14 CVEs |
before 8.0.2-3~14.04.1, plus listed versions 4.2.0-25.0.1-15.0.1-1ubuntu15.1.0-15.1.1-1 |
8.0.2-3~14.04.1 |
qpdfUbuntu:16.04:LTS From an advisory covering 14 CVEs |
before 8.0.2-3~16.04.1, plus listed versions 5.1.3-25.1.3-35.2.0-15.2.0-26.0.0-2 |
8.0.2-3~16.04.1 |
qpdfopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 10.3.2-1.3 | 10.3.2-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12595 is a high vulnerability (CVSS 7.8) in Qpdf Project Qpdf, published August 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in qpdf 7.0.0-r0.
References
github.com/qpdf/qpdf/issues/146
usn.ubuntu.com/3638-1
nvd.nist.gov/vuln/detail/CVE-2017-12595
security.alpinelinux.org/vuln/CVE-2017-12595
Show 39 moreShow less
security-tracker.debian.org/tracker/CVE-2017-12595
advisories.mageia.org/MGASA-2018-0145.html
bugs.mageia.org/show_bug.cgi?id=22648
openwall.com/lists/oss-security/2018/02/13/2
lists.opensuse.org/opensuse-updates/2018-02/msg00056.html
suse.com/support/update/announcement/2018/suse-su-20183066-1
bugzilla.suse.com/1040311
ubuntu.com/security/CVE-2017-12595
cve.org/CVERecord?id=CVE-2017-12595