CVE-2021-36978: 
NixOS vulnerability analysis and mitigation

QPDF versions 9.x through 9.1.1 and 10.x through 10.0.4 were found to contain a heap-based buffer overflow vulnerability in the Pl_ASCII85Decoder::write function, which is called from Pl_AES_PDF::flush and Pl_AES_PDF::finish when a certain downstream write fails. The vulnerability was discovered in 2020 and assigned CVE-2021-36978 (NVD, MITRE).

The vulnerability is classified as a heap-based buffer overflow (CWE-787: Out-of-bounds Write) that occurs in the Pl_ASCII85Decoder::write function. The issue manifests when the function is called from Pl_AES_PDF::flush and Pl_AES_PDF::finish operations and a downstream write operation fails. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to a heap-based buffer overflow condition, potentially resulting in program crashes or arbitrary code execution. The CVSS scoring indicates that while the vulnerability requires local access and user interaction, it could result in high impact on system availability (NVD, Gentoo).

The vulnerability was discovered through fuzzing, as evidenced by the OSS-Fuzz issue report. A proof-of-concept exploit has been documented that demonstrates the heap-buffer-overflow condition when processing specific PDF content (OSS-Fuzz, GitHub Issue).

The vulnerability has been fixed in QPDF version 10.1.0. Users are advised to upgrade to this version or later. Various distributions have also released security updates, including Debian with version 8.4.0-2+deb10u1 and Gentoo recommending version 10.1.0 or higher (Debian LTS, Gentoo).