cve/2017/CVE-2017-9209.md

CVE-2017-9209

Description

libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to QPDFObjectHandle::parseInternal, aka qpdf-infiniteloop2.

POC

Reference

• https://blogs.gentoo.org/ago/2017/05/21/qpdf-three-infinite-loop-in-libqpdf/

Github

• https://github.com/0xCyberY/CVE-T4PDF
• https://github.com/ARPSyndicate/cvemon