Published: 07/11/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

It exists that DjVuLibre incorrectly handled certain memory operations. If a user or automated system were tricked into processing a specially crafted DjVu file, a remote attacker could cause applications to hang or crash, resulting in a denial of service, or possibly execute arbitrary code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
djvulibre project djvulibre 3.5.27
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 10.0
debian debian linux 11.0
fedoraproject fedora 30
fedoraproject fedora 31
canonical ubuntu linux 18.04
canonical ubuntu linux 19.04
canonical ubuntu linux 19.10
canonical ubuntu linux 16.04
opensuse leap 15.0
opensuse leap 15.1

Debian Bug report logs - #945114 djvulibre: CVE-2019-18804 Package: src:djvulibre; Maintainer for src:djvulibre is Barak A Pearlmutter <bap@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 19 Nov 2019 21:15:02 UTC Severity: normal Tags: security, upstream Found in versions djvulibre/35 ...

Several security issues were fixed in DjVuLibre ...

Several vulnerabilities were discovered in djvulibre, a library and set of tools to handle documents in the DjVu format An attacker could crash document viewers and possibly execute arbitrary code through crafted DjVu files For the oldstable distribution (buster), these problems have been fixed in version 35271-10+deb10u1 For the stable distr ...

CWE-476 https://github.com/TeamSeri0us/pocs/blob/master/djvulibre/DJVU__filter_fv%40IW44EncodeCodec.cpp_499-43___SEGV_UNKNOW.md https://sourceforge.net/p/djvu/bugs/309/https://lists.debian.org/debian-lts-announce/2019/11/msg00004.html https://usn.ubuntu.com/4198-1/http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00069.html https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html https://www.debian.org/security/2021/dsa-5032 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYPWP5T7TSUNZV4UEIRRCTVWO6VBZWJV/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWT7E7BMWV5T33AMU6OGDPPTPIGCFFZF/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945114 https://usn.ubuntu.com/4198-1/https://nvd.nist.gov

CVE-2019-18804

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect