CVE-2017-11626

Name	CVE-2017-11626
Description	A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	ELA-942-1
Debian Bugs	871320

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qpdf (PTS)	jessie	5.1.2-2	vulnerable
	stretch (lts), stretch	6.0.0-2+deb9u2	fixed
	buster (security), buster, buster (lts)	8.4.0-2+deb10u1	fixed
	bullseye	10.1.0-1	fixed
	bookworm	11.3.0-1+deb12u1	fixed
	sid, trixie	11.9.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
qpdf	source	experimental	7.0~b1-1
qpdf	source	stretch	6.0.0-2+deb9u1		ELA-942-1
qpdf	source	(unstable)	7.0.0-1	low		871320

Notes

[stretch] - qpdf <no-dsa> (Minor issue)
[jessie] - qpdf <no-dsa> (Minor issue)
[wheezy] - qpdf <no-dsa> (Minor issue)
https://github.com/qpdf/qpdf/issues/119