Heap-based buffer overflow in QPDF - CVE-2024-24246

Vulnerability identifier: #VU87162

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24246

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the std::__shared_count() function in /bits/shared_ptr_base.h. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.

QPDF
Anolis OS
Ubuntu
Fedora
pdfmixtool-flatpak
pdfarranger-flatpak
libqpdf29 (Ubuntu package)
qpdf (Ubuntu package)
qpdf
qpdf-devel
qpdf-libs
qpdf-doc

Install updates from vendor's website.

pdfmixtool-flatpak - update to 1.1.1-3
pdfarranger-flatpak - update to 1.10.1-4
libqpdf29 (Ubuntu package) - update to 11.5.0-1ubuntu1.1
qpdf (Ubuntu package) - update to 11.5.0-1ubuntu1.1
qpdf - addressed in versions 11.6.4-2.fc38, 11.6.4-2.fc39, 11.9.0-1.fc40
qpdf - update to 11.9.1-1
qpdf-devel - update to 11.9.1-1
qpdf-libs - update to 11.9.1-1
qpdf-doc - update to 11.9.1-1

• https://github.com/qpdf/qpdf/issues/1123

• Denial of service in QPDF
• Fedora 39 update for qpdf
• Fedora 38 update for qpdf
• Fedora 40 update for qpdf
• Fedora 39 Flatpaks update for pdfarranger-flatpak
• Fedora 39 Flatpaks update for pdfmixtool-flatpak
• Ubuntu update for qpdf
• Anolis OS update for qpdf