CVE-2018-18385

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-183863.3drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block furtheCVE-2018-183878.8playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse.CVE-2018-183889.8eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary cCVE-2018-183899.8Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLSCVE-2018-183907.5User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183918.8User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183928.8Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183939.8Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183949.8Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183959.8Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183969.8Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183975.5The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated
CVE-2018-18385: High severity, CVSS 7.5 | Vulnix