CVE-2018-18020

Name of the Vulnerable Software and Affected Versions QPDF version 8.2.1

Description The issue is related to uncontrolled recursion in the libqpdf/QPDFWriter.cc component of the QPDF utility for converting PDF documents. This allows a remote attacker to cause a denial of service using a specially crafted PDF file. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For QPDF version 8.2.1, as a temporary workaround, consider restricting the use of the QPDFWriter::unparseObject and QPDFWriter::unparseChild functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.