PT-2018-3976 · Xpdf+2 · Xpdf+2

Fish · Published 2018-09-02 · Updated 2025-05-20 · CVE-2018-16369

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xpdf version 4.00

Description The issue is related to errors in the code of the Xpdf software, specifically in the XRef::fetch function in XRef.cc. It allows remote attackers to cause a denial of service, which is a stack consumption, via a crafted PDF file. This is related to the AcroForm::scanField function.

Recommendations For Xpdf version 4.00, consider disabling the XRef::fetch function as a temporary workaround until a patch is available. Restrict access to the AcroForm::scanField function to minimize the risk of exploitation. Avoid using the Xpdf software to process untrusted PDF files until the issue is resolved.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-17

CWE-404

Related Identifiers

ALT-PU-2024-10474

ALT-PU-2024-10804

ALT-PU-2024-7465

BDU:2024-01225

CVE-2018-16369

Affected Products

Alt Linux

Debian

Xpdf

References · 11

• 🔥 https://github.com/TeamSeri0us/pocs/tree/master/xpdf · Exploit
• https://ubuntu.com/security/CVE-2018-16369 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01225 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16369 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16369 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16369 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16369 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16369 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16369 · Vendor Advisory
• https://t.me/cvenotify/123140 · Telegram Post
• https://xpdfreader.com/security-bug/object-loops.html · Note