CVE Vulnerabilities

CVE-2017-11624

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Jul 25, 2017 | Modified: Oct 03, 2019
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
3.3 LOW
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Ubuntu

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an infinite loop.

Weakness

The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Qpdf Qpdf_project 6.0.0 6.0.0
Qpdf Ubuntu esm-infra/xenial *
Qpdf Ubuntu trusty *
Qpdf Ubuntu upstream *
Qpdf Ubuntu xenial *
Qpdf Ubuntu zesty *

References