Bug 647776 (CVE-2015-9252, CVE-2017-18183, CVE-2017-18184, CVE-2017-18185, CVE-2017-18186)

Summary:	<app-text/qpdf-7.0.0: Multiple vulnerabilities
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	printing
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/gentoo/gentoo/pull/8407
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2018-02-15 21:11:01 UTC

CVE-2017-18186 (https://nvd.nist.gov/vuln/detail/CVE-2017-18186):
  An issue was discovered in QPDF before 7.0.0. There is an infinite loop due
  to looping xref tables in QPDF.cc.

CVE-2017-18185 (https://nvd.nist.gov/vuln/detail/CVE-2017-18185):
  An issue was discovered in QPDF before 7.0.0. There is a large heap-based
  out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is
  caused by an integer overflow in the PNG filter.

CVE-2017-18184 (https://nvd.nist.gov/vuln/detail/CVE-2017-18184):
  An issue was discovered in QPDF before 7.0.0. There is a stack-based
  out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.

CVE-2017-18183 (https://nvd.nist.gov/vuln/detail/CVE-2017-18183):
  An issue was discovered in QPDF before 7.0.0. There is an infinite loop in
  the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc.

CVE-2015-9252 (https://nvd.nist.gov/vuln/detail/CVE-2015-9252):
  An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack
  exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related
  to the QPDF::resolve function in QPDF.cc.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2018-02-15 21:13:12 UTC

@Maintainers since qpdf is already being stabilized in bug 626446, could you please confirm if these CVEs are fixed in that version?

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-03-25 19:36:12 UTC

7.0.0 contains the fix and is already stable.

GLSA Vote: No

@maintainers, please clean the vulnerable versions.

Comment 3 Larry the Git Cow gentoo-dev

2018-05-15 14:24:31 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=93eba83ee616d8c388265c04645f1bdd5e9bab73

commit 93eba83ee616d8c388265c04645f1bdd5e9bab73
Author:     Aaron Bauman <bman@gentoo.org>
AuthorDate: 2018-05-14 22:39:24 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2018-05-15 14:24:04 +0000

    app-text/qpdf: drop vulnerable
    
    Bug: https://bugs.gentoo.org/647776
    Package-Manager: Portage-2.3.36, Repoman-2.3.9
    Closes: https://github.com/gentoo/gentoo/pull/8407

 app-text/qpdf/Manifest             |  3 --
 app-text/qpdf/qpdf-5.1.1-r1.ebuild | 59 --------------------------------------
 app-text/qpdf/qpdf-5.1.3-r1.ebuild | 59 --------------------------------------
 app-text/qpdf/qpdf-6.0.0-r2.ebuild | 55 -----------------------------------
 4 files changed, 176 deletions(-)