CVE-2018-18459

Name of the Vulnerable Software and Affected Versions Xpdf version 4.00

Description The issue allows remote attackers to cause a denial of service via a crafted pdf file. This is due to a NULL pointer dereference in the DCTStream::getBlock function in Stream.cc.

Recommendations For Xpdf version 4.00, consider avoiding the use of the DCTStream::getBlock function until a patch is available. As a temporary workaround, restrict the processing of crafted pdf files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.