CVE-2019-18804 Null dereference in n/a

High 7.5 Published 7 Nov 2019 Updated 5 Aug 2024

A NULL pointer dereference in DjVuLibre allows attackers to cause a denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-18804?

CVE-2019-18804 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 7 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.

Weakness: CWE-476

Which versions are affected by CVE-2019-18804?

It affects 5 products.

Linux distribution packages (12)

`djvulibre` SUSE:Linux Enterprise Module for Desktop Applications 15	All versions	`3.5.27-3.8.1`
`djvulibre` SUSE:Linux Enterprise Module for Desktop Applications 15 SP1	All versions	`3.5.27-3.8.1`
`djvulibre` SUSE:Linux Enterprise Module for Package Hub 15	All versions	`3.5.27-3.8.1`
`djvulibre` SUSE:Linux Enterprise Module for Package Hub 15 SP1	All versions	`3.5.27-3.8.1`
`djvulibre` SUSE:Linux Enterprise Server 12 SP4	All versions	`3.5.25.3-5.6.10`
`djvulibre` SUSE:Linux Enterprise Server 12 SP5	All versions	`3.5.25.3-5.6.10`
`djvulibre` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`3.5.25.3-5.6.10`
`djvulibre` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`3.5.25.3-5.6.10`
`djvulibre` SUSE:Linux Enterprise Software Development Kit 12 SP4	All versions	`3.5.25.3-5.6.10`
`djvulibre` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`3.5.25.3-5.6.10`
`djvulibre` openSUSE:Leap 15.0	All versions	`3.5.27-lp150.2.6.1`
`djvulibre` openSUSE:Leap 15.1	All versions	`3.5.27-lp151.3.6.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Djvulibre Project Djvulibre, Fedoraproject Fedora, Opensuse Leap.

How do I fix CVE-2019-18804?

Apply the vendor's patch.

Is CVE-2019-18804 being exploited?

There is no known exploitation of CVE-2019-18804 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-18804, DLA-1985-1, GHSA-mgvj-94j9-x737, SUSE-SU-2019:3033-1, SUSE-SU-2019:3033-2, SUSE-SU-2020:0970-1 and 3 more.