CVE-2018-14946
UnknownEPSS 1.60%
Last modified
CVE-2018-14946 is a vulnerability of currently unknown severity. An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Routines (malloc versus operator delete).. EPSS estimates a 1.60% chance of exploitation in the next 30 days.
Description
An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Routines (malloc versus operator delete).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flowpaper | Pdf2json | 0.69 |
References
- https://github.com/flexpaper/pdf2json/issues/19Exploit, Third Party Advisory
- https://github.com/fouzhe/security/tree/master/pdf2json#alloc_dealloc_mismatch-in-function-htmlstringExploit, Third Party Advisory
- https://github.com/flexpaper/pdf2json/issues/19Exploit, Third Party Advisory
- https://github.com/fouzhe/security/tree/master/pdf2json#alloc_dealloc_mismatch-in-function-htmlstringExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-14946?
An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Routines (malloc versus operator delete).
How severe is CVE-2018-14946?
Severity scoring for CVE-2018-14946 is pending analysis. The EPSS model estimates a 1.60% probability of exploitation in the next 30 days.
How do I fix CVE-2018-14946?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-14940PHPCMS 9 allows remote attackers to cause a denial of servic…
- CVE-2018-14941Harmonic NSG 9000 devices allow remote authenticated users t…
- CVE-2018-14942Harmonic NSG 9000 devices allow remote authenticated users t…
- CVE-2018-14943Harmonic NSG 9000 devices have a default password of nsgadmi…
- CVE-2018-14944An issue has been found in jpeg_encoder through 2015-11-27. …
- CVE-2018-14945An issue has been found in jpeg_encoder through 2015-11-27. …
- CVE-2018-14947An issue has been found in PDF2JSON 0.69. XmlFontAccu::CSSty…
- CVE-2018-14948An issue has been found in dilawar sound through 2017-11-27.…
- CVE-2018-1495IBM FlashSystem V840 and V900 products could allow an authen…6.5
- CVE-2018-14950The mail message display page in SquirrelMail through 1.4.22…
- CVE-2018-14951The mail message display page in SquirrelMail through 1.4.22…
- CVE-2018-14952The mail message display page in SquirrelMail through 1.4.22…
Are you affected by CVE-2018-14946?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST