CVE-2018-19149 describes a NULL pointer dereference vulnerability in Poppler versions prior to 0.70.0, specifically within the _poppler_attachment_new function when invoked by poppler_annot_file_attachment_get_attachment. This flaw affects various Poppler implementations, including those used in Canonical Ubuntu Linux and Freedesktop Poppler. With a CVSSv3 score of 6.5 (MEDIUM), this vulnerability can be triggered remotely with low attack complexity, requiring user interaction (UI:R). A successful exploit could lead to a denial-of-service (availability impact: H) but does not compromise confidentiality or integrity. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, indicating low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.70.0CPE matchmatch criteria | cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
18.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.