CVE-2019-18804

high-risk

Published 2019-11-07

DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.

Do I need to act?

4.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Djvulibre

Debian Linux

Fedora

Ubuntu Linux

Leap

Debian Canonical Fedoraproject Opensuse Djvulibre Project

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00068.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00069.html

Exploit https://github.com/TeamSeri0us/pocs/blob/master/djvulibre/DJVU__filter_fv%40IW44...

Mailing List https://lists.debian.org/debian-lts-announce/2019/11/msg00004.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html

Exploit https://sourceforge.net/p/djvu/bugs/309/

Third Party Advisory https://usn.ubuntu.com/4198-1/

Third Party Advisory https://www.debian.org/security/2021/dsa-5032

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00068.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00069.html

Exploit https://github.com/TeamSeri0us/pocs/blob/master/djvulibre/DJVU__filter_fv%40IW44...

Mailing List https://lists.debian.org/debian-lts-announce/2019/11/msg00004.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html

and 4 more references

/ 100

high-risk

Severity 26/34 · High

Exploitability 8/34 · Low

Exposure 17/34 · Moderate