Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 23.10: USN-6713-1 medium: qpdf Denial Of Service

ubuntu
Calendar Grey March 25, 2024
Dist Ubuntu Esm H88
A vulnerability impacting Ubuntu 23.10 QPDF could lead to a crash or arbitrary code execution through a specially designed JSON file. It is advised to apply the update promptly.
QPDF could be made to crash or run programs if it opened a specially crafted file.

Summary

QPDF could be made to crash or run programs if it opened a specially

crafted file.

Software Description:

- qpdf: tools for transforming and inspecting PDF files

Details:

It was discovered that QPDF incorrectly handled certain memory operations

when decoding JSON files. If a user or automated system were tricked into

processing a specially crafted JSON file, QPDF could be made to crash,

resulting in a denial of service, or possibly execute arbitrary code.

Topics%20covered

Topics Covered

security advisory security issue Ubuntu Denial of Service service interruption qpdf memory operation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   libqpdf29                       11.5.0-1ubuntu1.1
   qpdf                            11.5.0-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6713-1

CVE-2024-24246

Severity
medium
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6713-1

Topics%20covered

Topics Covered

security advisory security issue Ubuntu Denial of Service service interruption qpdf memory operation

Package Information

https://launchpad.net/ubuntu/+source/qpdf/11.5.0-1ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here