rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-16551 
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T22:00:00.000Z
CVE-2018-16552 
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T22:00:00.000Z
CVE-2018-16553 
In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:11:15.000Z
CVE-2018-16554 
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-16T02:00:00.000Z
CVE-2018-16555 
A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All versions < V4.0.1.1), SCALANCE S627-2M (All versions < V4.0.1.1). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens AG
product: SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M
Published: 2018-12-13T16:00:00.000Z
CVE-2018-16558 
A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: description: Improper Input Validation
Affected products: vendor: Siemens
product: SIMATIC S7-1500 CPU
vendor: Siemens
product: SIMATIC S7-1500 CPU
Published: 2019-04-17T13:38:34.000Z
CVE-2018-16559 
A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: description: Improper Input Validation
Affected products: vendor: Siemens
product: SIMATIC S7-1500 CPU
vendor: Siemens
product: SIMATIC S7-1500 CPU
Published: 2019-04-17T13:38:34.000Z
CVE-2018-16561 
A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication packets which could cause a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart. Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the core functionality of the CPU, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.
Problem types: description: Improper Input Validation
Affected products: vendor: Siemens
product: SIMATIC S7-300 CPUs
Published: 2019-04-17T13:38:34.000Z
CVE-2018-16563 
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: description: Other
Affected products: vendor: Siemens
product: Firmware variant IEC 61850 for EN100 Ethernet module
vendor: Siemens
product: Firmware variant MODBUS TCP for EN100 Ethernet module
vendor: Siemens
product: Firmware variant DNP3 TCP for EN100 Ethernet module
vendor: Siemens
product: Firmware variant IEC104 for EN100 Ethernet module
vendor: Siemens
product: Firmware variant Profinet IO for EN100 Ethernet module
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules
Published: 2019-03-21T14:57:36.000Z
CVE-2018-16585 
An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T13:00:00.000Z
CVE-2018-16586 
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-16587 
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-16588 
Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks.  NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T22:00:00.000Z
CVE-2018-16590 
FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z
CVE-2018-16591 
FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-10T17:00:00.000Z
CVE-2018-16593 
The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T18:18:21.000Z
CVE-2018-16594 
The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T18:13:28.000Z
CVE-2018-16595 
The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T18:08:12.000Z
CVE-2018-16596 
A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only possible if the attacker is inside the LAN. Because of ASLR, the success rate is not 100% and leads instead to a DoS of the UPnP service. The remaining functionality of the Internet Box is not affected. A reboot of the Internet Box is necessary to attempt the exploit again.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-16597 
An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-16598 
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-16599 
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of NBNS packets in prvTreatNBNS can be used for information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-16600 
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-16601 
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-16602 
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of DHCP responses in prvProcessDHCPReplies can be used for information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-16603 
An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds access to TCP source and destination port fields in xProcessReceivedTCPPacket can leak data back to an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-16604 
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes (e.g., "${phpinfo()}").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T16:00:00.000Z
CVE-2018-16605 
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T16:00:00.000Z
CVE-2018-16606 
In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal information (Name, Email, Organization, and Position) by changing the value of Paper ID (the pid parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T16:00:00.000Z
CVE-2018-16607 
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T15:00:00.000Z
CVE-2018-16608 
In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-10T13:00:00.000Z
CVE-2018-16613 
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T17:59:49.000Z
CVE-2018-16618 
VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668 listening for requests on localhost. Requests submitted to this service are checked for a string of random characters followed by the name of an Android activity to start. Activities are started by inserting their name into a string that is executed in a shell command. By inserting metacharacters this can be exploited to run arbitrary commands as root. The requests also match those of the HTTP protocol and can be triggered on any web page rendered on the device by requesting resources stored at an http://127.0.0.1:1668/ URI, as demonstrated by the http://127.0.0.1:1668/dacdb70556479813fab2d92896596eef?';{ping,example.org}' URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T17:48:14.000Z
CVE-2018-16619 
Sonatype Nexus Repository Manager before 3.14 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T20:00:00.000Z
CVE-2018-16620 
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T20:00:00.000Z
CVE-2018-16621 
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T20:00:00.000Z
CVE-2018-16622 
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T19:00:00.000Z
CVE-2018-16623 
Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:57:55.000Z
CVE-2018-16624 
panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:56:27.000Z
CVE-2018-16625 
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:54:54.000Z
CVE-2018-16626 
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:53:20.000Z
CVE-2018-16627 
panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-16628 
panel/login in Kirby v2.5.12 allows XSS via a blog name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-04T16:00:00.000Z
CVE-2018-16629 
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-04T16:00:00.000Z
CVE-2018-16630 
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-16631 
Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-04T16:00:00.000Z
CVE-2018-16632 
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-16633 
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-04T16:00:00.000Z
CVE-2018-16634 
Pluck v4.7.7 allows CSRF via admin.php?action=settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-04T16:00:00.000Z
CVE-2018-16635 
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T18:00:00.000Z
CVE-2018-16636 
Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T18:00:00.000Z
CVE-2018-16637 
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-16638 
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-16639 
Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:52:00.000Z
CVE-2018-16640 
ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T22:00:00.000Z
CVE-2018-16641 
ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T22:00:00.000Z
CVE-2018-16642 
The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T22:00:00.000Z
CVE-2018-16643 
The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T22:00:00.000Z
CVE-2018-16644 
There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T22:00:00.000Z
CVE-2018-16645 
There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T22:00:00.000Z
CVE-2018-16646 
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z
CVE-2018-16647 
In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation fault in fz_write_data in fitz/output.c) via a crafted pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z