CVE-2018-10289

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this vulnerability to cause a denial of service via a crafted pdf file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10297.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-102946.1Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS.CVE-2018-102958.8ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.CVE-2018-102966.1MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.CVE-2018-102975.4Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associate CVE-2018-102985.4Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does CVE-2018-102997.5An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 tok CVE-2018-10308.8A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka CVE-2018-103006.1Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to in CVE-2018-103016.1Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attacke CVE-2018-103027.8A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-j CVE-2018-103038.8A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-y