NetSight
IP …
medium6.5

CVE-2018-20481

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer deref…

Impact

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.

Affected products

VendorProductAffected versions
FreedesktopPoppler
Version 0.72.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
DebianDebian Linux
Version 8.0

Weakness classification

CWE-476

References