Security update for qpdf SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2669-1 Final 1 1 2022-08-04T08:24:53Z current 2022-08-04T08:24:53Z 2022-08-04T08:24:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for qpdf This update for qpdf fixes the following issues: - CVE-2022-34503: Fixed a heap buffer overflow via the function QPDF::processXRefStream (bsc#1201830). - CVE-2021-36978: Fixed heap-based buffer overflow in Pl_ASCII85Decoder::write (bsc#1188514). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2669,SUSE-OpenStack-Cloud-9-2022-2669,SUSE-OpenStack-Cloud-Crowbar-9-2022-2669,SUSE-SLE-SAP-12-SP4-2022-2669,SUSE-SLE-SDK-12-SP5-2022-2669,SUSE-SLE-SERVER-12-SP2-BCL-2022-2669,SUSE-SLE-SERVER-12-SP3-BCL-2022-2669,SUSE-SLE-SERVER-12-SP4-LTSS-2022-2669,SUSE-SLE-SERVER-12-SP5-2022-2669 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222669-1/ Link for SUSE-SU-2022:2669-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011801.html E-Mail link for SUSE-SU-2022:2669-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188514 SUSE Bug 1188514 https://bugzilla.suse.com/1201830 SUSE Bug 1201830 https://www.suse.com/security/cve/CVE-2021-36978/ SUSE CVE CVE-2021-36978 page https://www.suse.com/security/cve/CVE-2022-34503/ SUSE CVE CVE-2022-34503 page SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libqpdf18-7.1.1-3.8.1 qpdf-7.1.1-3.8.1 qpdf-devel-7.1.1-3.8.1 libqpdf18-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qpdf-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libqpdf18-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL qpdf-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libqpdf18-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS qpdf-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libqpdf18-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP5 qpdf-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server 12 SP5 libqpdf18-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 qpdf-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libqpdf18-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 qpdf-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 qpdf-devel-7.1.1-3.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libqpdf18-7.1.1-3.8.1 as a component of SUSE OpenStack Cloud 9 qpdf-7.1.1-3.8.1 as a component of SUSE OpenStack Cloud 9 libqpdf18-7.1.1-3.8.1 as a component of SUSE OpenStack Cloud Crowbar 9 qpdf-7.1.1-3.8.1 as a component of SUSE OpenStack Cloud Crowbar 9 QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails. CVE-2021-36978 SUSE Linux Enterprise Server 12 SP2-BCL:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP2-BCL:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP3-BCL:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP3-BCL:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP4-LTSS:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP5:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP5:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:qpdf-devel-7.1.1-3.8.1 SUSE OpenStack Cloud 9:libqpdf18-7.1.1-3.8.1 SUSE OpenStack Cloud 9:qpdf-7.1.1-3.8.1 SUSE OpenStack Cloud Crowbar 9:libqpdf18-7.1.1-3.8.1 SUSE OpenStack Cloud Crowbar 9:qpdf-7.1.1-3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222669-1/ https://www.suse.com/security/cve/CVE-2021-36978.html CVE-2021-36978 https://bugzilla.suse.com/1188514 SUSE Bug 1188514 QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. CVE-2022-34503 SUSE Linux Enterprise Server 12 SP2-BCL:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP2-BCL:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP3-BCL:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP3-BCL:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP4-LTSS:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP5:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server 12 SP5:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libqpdf18-7.1.1-3.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:qpdf-7.1.1-3.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:qpdf-devel-7.1.1-3.8.1 SUSE OpenStack Cloud 9:libqpdf18-7.1.1-3.8.1 SUSE OpenStack Cloud 9:qpdf-7.1.1-3.8.1 SUSE OpenStack Cloud Crowbar 9:libqpdf18-7.1.1-3.8.1 SUSE OpenStack Cloud Crowbar 9:qpdf-7.1.1-3.8.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222669-1/ https://www.suse.com/security/cve/CVE-2022-34503.html CVE-2022-34503 https://bugzilla.suse.com/1201830 SUSE Bug 1201830