Vulnetix
Try Vulnetix Request Demo
CVE-2018-18456 PUBLISHED

The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm.

EPSS 0.53% · 66.9th percentile

Risk Scores

EPSS Score
0.53%
66.9th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSipe7.2.24+dfsg1-1build1, 0, 7.2.23+dfsg1-2
Ubuntu:20.04:LTSipe7.2.13-2build1, 0, 7.2.9-1
Ubuntu:16.04:LTSxpdf3.03-17ubuntu5, 3.03-18, 3.04-1
Ubuntu:25.10ipe0, 7.2.30-1build1
Ubuntu:16.04:LTSipe7.1.10-1, 7.1.10-1.1, 7.1.4-2.1
Ubuntu:25.10xpdf0, 3.04+git20250304-1
Ubuntu:18.04:LTSxpdf3.04-6ubuntu1, 0, 3.04-4build1
Ubuntu:24.04:LTSipe7.2.28-2, 7.2.28-2.1build2, 7.2.28-2.1build3
Ubuntu:22.04:LTSxpdf3.04+git20210103-3build1, 3.04+git20211021-1, 3.04+git20211021-1ubuntu1
Ubuntu:18.04:LTSipe0, 7.2.7-3, 7.2.7-2
Ubuntu:24.04:LTSxpdf3.04+git20240118-1, 3.04+git20240124-1, 3.04+git20240202-1

Timeline

References

Open in Interactive Console →