CVE-2018-6192

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/102822Third Party Advisory, VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=698916Exploit, Issue Tracking, Third Party Advisory
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=5e411a99604ff6be5db9e273ee84737204113299
https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html
https://security.gentoo.org/glsa/201811-15Third Party Advisory
https://www.debian.org/security/2018/dsa-4334Third Party Advisory
http://www.securityfocus.com/bid/102822Third Party Advisory, VDB Entry
https://bugs.ghostscript.com/show_bug.cgi?id=698916Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html
https://security.gentoo.org/glsa/201811-15Third Party Advisory
https://www.debian.org/security/2018/dsa-4334Third Party Advisory

Timeline

Published: Jan 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-61934.7A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph action to cgi-bin/r CVE-2018-61944.8A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-ima CVE-2018-61957.2admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authentica CVE-2018-61967.5w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prev CVE-2018-61977.5w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.CVE-2018-61984.7w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a CVE-2018-62006.1vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.CVE-2018-62017.8In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un CVE-2018-62027.8In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un CVE-2018-62037.8In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have un CVE-2018-62047.8In Max Secure Anti Virus 19.0.3.019,, the driver file (SDActMon.sys) allows local users to cause a denial of service (BSOD) or possibly have CVE-2018-62057.8In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibl