CVE-2018-20650

moderate-risk

Published 2019-01-01

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.

Do I need to act?

0.36% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Poppler

Ubuntu Linux

Debian Linux

Enterprise Linux

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Affected Vendors

Debian Redhat Canonical Freedesktop

References (18)

Third Party Advisory http://www.securityfocus.com/bid/106459

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2022

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2713

Patch https://gitlab.freedesktop.org/poppler/poppler/commit/de0c0b8324e776f0b851485e0f...

Issue Tracking https://gitlab.freedesktop.org/poppler/poppler/issues/704

Mailing List https://lists.debian.org/debian-lts-announce/2019/09/msg00033.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html

Mailing List https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html

Third Party Advisory https://usn.ubuntu.com/3865-1/