Nixpkgs security tracker
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
10 packages
- capypdf
- python312Packages.pypdf2
- python312Packages.pypdf3
- python313Packages.pypdf2
- python313Packages.pypdf3
- python314Packages.pypdf2
- python314Packages.pypdf3
- python312Packages.pypdfium2
- python313Packages.pypdfium2
- python314Packages.pypdfium2
- @LeSuisse accepted
- @LeSuisse published on GitHub
pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.
References
-
https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p x_refsource_CONFIRM
-
https://github.com/py-pdf/pypdf/pull/3734 x_refsource_MISC
Ignored references (1)
-
https://github.com/py-pdf/pypdf/releases/tag/6.10.2 x_refsource_MISC
Affected products
- ==< 6.10.2
Matching in nixpkgs
pkgs.python312Packages.pypdf
None
pkgs.python313Packages.pypdf
Pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
pkgs.python314Packages.pypdf
Pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files
Ignored packages (10)
pkgs.capypdf
Fully color managed PDF generation library
pkgs.python312Packages.pypdf2
None
pkgs.python312Packages.pypdf3
None
pkgs.python313Packages.pypdf2
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf2-3.0.1
- nixpkgs-unstable pypdf2-3.0.1
- nixos-unstable-small pypdf2-3.0.1
pkgs.python313Packages.pypdf3
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf3-1.0.6
- nixpkgs-unstable pypdf3-1.0.6
- nixos-unstable-small pypdf3-1.0.6
pkgs.python314Packages.pypdf2
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf2-3.0.1
- nixpkgs-unstable pypdf2-3.0.1
- nixos-unstable-small pypdf2-3.0.1
pkgs.python314Packages.pypdf3
Pure-Python library built as a PDF toolkit
-
nixos-unstable pypdf3-1.0.6
- nixpkgs-unstable pypdf3-1.0.6
- nixos-unstable-small pypdf3-1.0.6
pkgs.python312Packages.pypdfium2
None
pkgs.python313Packages.pypdfium2
Python bindings to PDFium
-
nixos-unstable pypdfium2-5.7.0
- nixpkgs-unstable pypdfium2-5.7.0
- nixos-unstable-small pypdfium2-5.7.0
pkgs.python314Packages.pypdfium2
Python bindings to PDFium
-
nixos-unstable pypdfium2-5.7.0
- nixpkgs-unstable pypdfium2-5.7.0
- nixos-unstable-small pypdfium2-5.7.0
Package maintainers
-
@javaes Jan van Esdonk <jan+dev@vanesdonk.de>