CVE-2020-18972

Publication date 25 August 2021

Last updated 11 July 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

Description

Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component 'src/base/PdfToenizer.cpp'.

Status

Package Ubuntu Release Status
libpodofo 24.10 oracular Ignored end of life, was ignored [vulnerability has been disputed by upstream maintainers]
24.04 LTS noble Ignored vulnerability has been disputed by upstream maintainers
23.10 mantic Ignored end of life, was needs-triage
23.04 lunar Ignored end of life, was needs-triage
22.10 kinetic Ignored end of life, was needs-triage
22.04 LTS jammy Ignored vulnerability has been disputed by upstream maintainers
21.10 impish Ignored end of life
21.04 hirsute Ignored end of life
20.04 LTS focal Ignored end of standard support, was ignored [vulnerability has been disputed by upstream maintainers]
18.04 LTS bionic Ignored end of standard support, was needs-triage
16.04 LTS xenial Ignored end of standard support
14.04 LTS trusty Ignored end of standard support

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.5 · Medium

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Other references

Access our resources on patching vulnerabilities