CVE-2018-19208
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener:...
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
CVE-2018-19208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
CVE-2018-19208- Updated
- 2026-11-02
EUVDEUVD-2018-10917 No score
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
EUVD-2018-10917- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5xpj-2ffv-fr89
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener:...
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
GHSA-5xpj-2ffv-fr89- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
CVE-2018-19208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-19208
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
DEBIAN-CVE-2018-19208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2019:2126
Red Hat Security Advisory: libwpd security update
- Record
RHSA-2019:2126- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-19208
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
- Record
UBUNTU-CVE-2018-19208- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0481 No score
Updated libwpd packages fix security vulnerability
It was discovered there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack (CVE-2018-19208).
- Record
MGASA-2018-0481- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11013-1 No score
libwpd-0_10-10-0.10.3-2.3 on GA media
These are all security issues fixed in the libwpd-0_10-10-0.10.3-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11013-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3812-1 No score
Security update for libwpd
This update for libwpd fixes the following issues:
Security issue fixed:
- CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713).
- Record
SUSE-SU-2018:3812-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3812-2 No score
Security update for libwpd
This update for libwpd fixes the following issues:
Security issue fixed:
- CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713).
- Record
SUSE-SU-2018:3812-2- Updated
- 2026-11-02
OSVSUSE-SU-2018:3870-1 No score
Security update for libwpd
This update for libwpd fixes the following issues:
Security issue fixed:
- CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713).
- Record
SUSE-SU-2018:3870-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libwpdDebian:12 |
before 0.10.2-3 | 0.10.2-3 |
libwpdDebian:13 |
before 0.10.2-3 | 0.10.2-3 |
libwpdDebian:14 |
before 0.10.2-3 | 0.10.2-3 |
libwpdMageia:6 |
before 0.10.2-1.1.mga6 | 0.10.2-1.1.mga6 |
libwpdRed Hat:enterprise_linux:7::client |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-debuginfoRed Hat:enterprise_linux:7::client |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-develRed Hat:enterprise_linux:7::client |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-docRed Hat:enterprise_linux:7::client |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-toolsRed Hat:enterprise_linux:7::client |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpdRed Hat:enterprise_linux:7::computenode |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libwpd-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-develRed Hat:enterprise_linux:7::computenode |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-docRed Hat:enterprise_linux:7::computenode |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-toolsRed Hat:enterprise_linux:7::computenode |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpdRed Hat:enterprise_linux:7::server |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-debuginfoRed Hat:enterprise_linux:7::server |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-develRed Hat:enterprise_linux:7::server |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-docRed Hat:enterprise_linux:7::server |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-toolsRed Hat:enterprise_linux:7::server |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpdRed Hat:enterprise_linux:7::workstation |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-develRed Hat:enterprise_linux:7::workstation |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-docRed Hat:enterprise_linux:7::workstation |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpd-toolsRed Hat:enterprise_linux:7::workstation |
before 0:0.10.0-2.el7 | 0:0.10.0-2.el7 |
libwpdSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.10.2-2.7.1 | 0.10.2-2.7.1 |
libwpdSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.10.2-2.7.1 | 0.10.2-2.7.1 |
libwpdSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.10.2-2.7.1 | 0.10.2-2.7.1 |
libwpdSUSE:Linux Enterprise Desktop 12 SP4 |
before 0.10.2-2.7.1 | 0.10.2-2.7.1 |
libwpdSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 0.10.2-2.7.1 | 0.10.2-2.7.1 |
libwpdSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 0.10.2-2.7.1 | 0.10.2-2.7.1 |
libwpdSUSE:Linux Enterprise Workstation Extension 15 |
before 0.10.2-3.3.1 | 0.10.2-3.3.1 |
libwpdUbuntu:16.04:LTS |
All versions, plus listed versions 0.10.0-2ubuntu40.10.1-1ubuntu1 |
None known |
libwpdUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.2-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-19208 is a medium vulnerability (CVSS 6.5) in Libwpd Project Libwpd, published November 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in libwpd 0.10.2-3.
References
bugzilla.redhat.com/show_bug.cgi?id=1643752
access.redhat.com/errata/RHSA-2019:2126
nvd.nist.gov/vuln/detail/CVE-2018-19208
github.com/advisories/GHSA-5xpj-2ffv-fr89
security-tracker.debian.org/tracker/CVE-2018-19208
advisories.mageia.org/MGASA-2018-0481.html
Show 16 moreShow less
bugs.mageia.org/show_bug.cgi?id=23864
lists.suse.com/pipermail/sle-security-updates/2018-November/004865.html
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2126.json
cve.org/CVERecord?id=CVE-2018-19208
suse.com/support/update/announcement/2018/suse-su-20183812-1
bugzilla.suse.com/1115713
ubuntu.com/security/CVE-2018-19208