CVE-2020-18972

Publication date 25 August 2021

Last updated 11 July 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

Description

Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component 'src/base/PdfToenizer.cpp'.

Status

Package Ubuntu Release Status
libpodofo 24.10 oracular Ignored end of life, was ignored [vulnerability has been disputed by upstream maintainers]
24.04 LTS noble Ignored vulnerability has been disputed by upstream maintainers
23.10 mantic Ignored end of life, was needs-triage
23.04 lunar Ignored end of life, was needs-triage
22.10 kinetic Ignored end of life, was needs-triage
22.04 LTS jammy Ignored vulnerability has been disputed by upstream maintainers
21.10 impish Ignored end of life
21.04 hirsute Ignored end of life
20.04 LTS focal Ignored vulnerability has been disputed by upstream maintainers
18.04 LTS bionic Ignored vulnerability has been disputed by upstream maintainers
16.04 LTS xenial Ignored vulnerability has been disputed by upstream maintainers
14.04 LTS trusty Ignored vulnerability has been disputed by upstream maintainers

Severity score breakdown

Parameter Value
Base score 5.5 · Medium
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Other references