NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by copac2xml.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2843
https://docs.google.com/document/d/1k598A16gV9HPwFXnYkyrPwoRbnbFX6LAMRyzb_dxLCM/edit