CVE-2018-20349

NameCVE-2018-20349
DescriptionThe igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2055-1
Debian Bugs917211, 917212

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
igraph (PTS)bullseye0.8.5+ds1-1fixed
bookworm0.10.2+ds-2fixed
sid, trixie0.10.13+ds-2fixed
r-cran-igraph (PTS)bullseye1.2.6-1fixed
bookworm1.3.5-3fixed
sid, trixie2.0.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
igraphsourcejessie0.7.1-2+deb8u1DLA-2055-1
igraphsourcestretch0.7.1-2.1+deb9u1
igraphsource(unstable)0.7.1-3917211
r-cran-igraphsourcestretch1.0.1-1+deb9u1
r-cran-igraphsource(unstable)1.2.2-2917212

Notes

https://github.com/igraph/igraph/issues/1141
Fixed by: https://github.com/igraph/igraph/commit/e3a9566e6463186230f215151b57b893df6d9ce2

Search for package or bug name: Reporting problems