6.5

CVE-2018-20650

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freedesktop ≫ Poppler Version 0.72.0
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.10
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Eus Version 8.1
Redhat ≫ Enterprise Linux Eus Version 8.2
Redhat ≫ Enterprise Linux Eus Version 8.4
Redhat ≫ Enterprise Linux Eus Version 8.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.68% 0.839
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2019:2022
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2713
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/3865-1/
Third Party Advisory
http://www.securityfocus.com/bid/106459
Third Party Advisory
VDB Entry
https://gitlab.freedesktop.org/poppler/poppler/commit/de0c0b8324e776f0b851485e0fc9622fc35695b7
Patch
Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/issues/704
Patch
Third Party Advisory
Issue Tracking
https://lists.debian.org/debian-lts-announce/2019/09/msg00033.html
Third Party Advisory
Mailing List