CVE-2021-25786

NameCVE-2021-25786
DescriptionAn issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3548-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qpdf (PTS)buster8.4.0-2vulnerable
buster (security)8.4.0-2+deb10u1fixed
bullseye10.1.0-1fixed
bookworm11.3.0-1+deb12u1fixed
trixie11.9.0-1fixed
sid11.9.0-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qpdfsourcebuster8.4.0-2+deb10u1DLA-3548-1
qpdfsource(unstable)10.1.0-1

Notes

https://github.com/qpdf/qpdf/issues/492
https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5 (release-qpdf-10.1.0)

Search for package or bug name: Reporting problems