MGASA-2018-0131
Updated qpdf packages fix security vulnerability
No scoreFix available
Qpdf has been updated to the latest version to fix several security issues.
- Stack overflow due to endless recursion in QPDFTokenizer::resolveLiteral()
- Another stack overflow / endless recursion in QPDFWriter::enqueueObject()
- Stack out of bounds read in iterate_rc4()
- heap out of bounds read (large) in Pl_Buffer::write
- Hang due to a pdf xref loop Also, the cups-filters package has been rebuilt for the new qpdf.
What each source reports
OSV No score
Updated qpdf packages fix security vulnerability
Qpdf has been updated to the latest version to fix several security issues.
- Stack overflow due to endless recursion in QPDFTokenizer::resolveLiteral()
- Another stack overflow / endless recursion in QPDFWriter::enqueueObject()
- Stack out of bounds read in iterate_rc4()
- heap out of bounds read (large) in Pl_Buffer::write
- Hang due to a pdf xref loop Also, the cups-filters package has been rebuilt for the new qpdf.
- Record
MGASA-2018-0131- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qpdfMageia:6 |
before 7.1.1-1.mga6 | 7.1.1-1.mga6 |
cups-filtersMageia:6 |
before 1.13.4-2.2.mga6 | 1.13.4-2.2.mga6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2018-0131 is a vulnerability with no CVSS score yet in qpdf, published February 22, 2018. No source lists public exploit code. Fixed in qpdf 7.1.1-1.mga6.