Bug 8989

Summary:	qpdf security update (CVE-2018-9918)
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Zombie Ryushu <zombie.ryushu>
Component:	Packages from Main	Assignee:	ROSA Linux Bugs <bugs>
Status:	RESOLVED DUPLICATE	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	andrey.bondrov, denis.silakov, mc2374
Version:	Plasma5
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	https://advisories.mageia.org/MGASA-2018-0232.html
Whiteboard:
Platform:	---	ROSA Vulnerability identifier:	CVE-2018-9918
RPM Package:	qpdf-6.0.0-3.src.rpm	ISO-related:
Bad POT generating:		Upstream:

Description Zombie Ryushu 2018-05-14 00:17:57 MSK

A flaw was found in QPDF through 8.0.2. libqpdf.a mishandles certain
'expected dictionary key but found non-name object' cases, allowing
remote attackers to cause a denial of service (stack exhaustion),
related to the QPDFObjectHandle and QPDF_Dictionary classes
(CVE-2018-9918).

Comment 1 Denis Silakov 2018-08-27 11:41:24 MSK

Will handle in scope of #9260

*** This bug has been marked as a duplicate of bug 9260 ***