CVE-2018-20650: Input Validation
Published Jan 1, 2019
·Updated
A flaw was found in Poppler 0.72.0. A reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc file allows attackers to cause a denial of service due to the lack of a check for the dict data type.
References: https://gitlab.freedesktop.org/poppler/poppler/issues/704
Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/commit/de0c0b8324e776f0b851485e0fc9622fc35695b7
Other sources
A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
— Launchpad
Affected Software
23 affected componentsFixes available
Freedesktop poppler=0.72.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Eus=8.1
redhat Enterprise Linux Eus=8.2
redhat Enterprise Linux Eus=8.4
redhat Enterprise Linux Eus=8.6
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=8.2
redhat Enterprise Linux Server Aus=8.4
redhat Enterprise Linux Server Aus=8.6
redhat Enterprise Linux Server Tus=8.2
redhat Enterprise Linux Server Tus=8.4
redhat Enterprise Linux Server Tus=8.6
redhat Enterprise Linux Workstation=7.0
debian/poppler
20.09.0-3.1+deb11u120.09.0-3.1+deb11u222.12.0-2+deb12u125.03.0-5+deb13u225.03.0-11.1
Remediation
Patch Available
Event History
Jan 1, 2019
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 10, 2019
Data Sourced
via Red Hat·08:09 PM
DescriptionSeverityAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:00 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·07:05 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·07:06 PM
DescriptionAffected Software