CVE Vulnerabilities

CVE-2018-16646

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Sep 06, 2018 | Modified: Jul 23, 2020
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
4.3 LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Ubuntu

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.

Weakness

The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Poppler Freedesktop 0.68.0 0.68.0
Red Hat Enterprise Linux 7 RedHat evince-0:3.28.2-8.el7 *
Red Hat Enterprise Linux 7 RedHat okular-0:4.10.5-7.el7 *
Red Hat Enterprise Linux 7 RedHat poppler-0:0.26.5-38.el7 *
Poppler Ubuntu bionic *
Poppler Ubuntu cosmic *
Poppler Ubuntu devel *
Poppler Ubuntu esm-infra/xenial *
Poppler Ubuntu trusty *
Poppler Ubuntu xenial *

References