FreeDesktop

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any FreeDesktop product.

RSS Feeds for FreeDesktop security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in FreeDesktop products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by FreeDesktop Sorted by Most Security Vulnerabilities since 2018

FreeDesktop Poppler56 vulnerabilities

FreeDesktop Systemd24 vulnerabilities

FreeDesktop Dbus19 vulnerabilities

FreeDesktop Xdg Utils4 vulnerabilities

FreeDesktop Accountsservice3 vulnerabilities

FreeDesktop Libbsd2 vulnerabilities

FreeDesktop Udisks2 vulnerabilities

FreeDesktop Freetype Demo Programs1 vulnerability

FreeDesktop Gst Plugins Bad1 vulnerability

FreeDesktop Libdbus1 vulnerability

FreeDesktop Libice1 vulnerability

FreeDesktop Libinput1 vulnerability

FreeDesktop Packagekit1 vulnerability

FreeDesktop Polkit1 vulnerability

FreeDesktop Spice Gtk1 vulnerability

FreeDesktop Xdg User Dirs1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in FreeDesktop. Last year, in 2025 FreeDesktop had 5 security vulnerabilities published. Right now, FreeDesktop is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	5	3.63
2024	2	5.90
2023	10	6.39
2022	9	7.18
2021	6	7.14
2020	10	5.81
2019	28	6.58
2018	21	6.96

It may take a day or so for new FreeDesktop vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent FreeDesktop Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-43718	Oct 01, 2025	Poppler 24.06.1-25.03: SEGV via deep metadata recursion (GTS_PDFEVersion) Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).	Poppler
CVE-2025-50420	Aug 04, 2025	Poppler v25.04.0 pdfseparate DoS via Infinite Recursion An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).	Poppler
CVE-2025-52968	Jun 23, 2025	CVE-2025-52968: xdg-utils <=1.2.1 xdg-open CSRF via SameSite=Strict xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.	Xdg Utils
CVE-2025-32365	Apr 05, 2025	OOB Read in Poppler <25.04 via JBIG2Bitmap::combine function Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.	Poppler
CVE-2025-32364	Apr 05, 2025	Poppler <25.04.0 FP Exception in PSStack::roll Causes Crash A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.	Poppler
CVE-2024-56378	Dec 23, 2024	Poppler: Out-of-Bounds Read in JBIG2Bitmap::combine Function libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.	Poppler
CVE-2024-6239	Jun 21, 2024	Poppler pdfinfo -dests Crash Causing DoS A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.	Poppler
CVE-2022-37050	Aug 22, 2023	Poppler 22.07.0 PDFDoc::savePageAs DoS via mishandled xref In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.	Poppler
CVE-2022-38349	Aug 22, 2023	Poppler 22.08.0 DoS via Assertion in Object.h (PDFDoc::replacePageDict) An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.	Poppler
CVE-2022-37051	Aug 22, 2023	Poppler 22.07.0 DOS via pdfunite.cc abort (stream check missing) An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.	Poppler
CVE-2022-37052	Aug 22, 2023	Poppler 22.07.0 Object::getString Assertion Denial of Service A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.	Poppler
CVE-2020-23804	Aug 22, 2023	Poppler 0.89.0 pdfinfo/pdftops DOS via Uncontrolled Recursion Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.	Poppler
CVE-2020-18839	Aug 22, 2023	CVE202018839: Poppler 0.75.0 Buffer Overflow in HtmlOutputDev::page (pre-0.75.1) Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.	Poppler
CVE-2020-36023	Aug 11, 2023	Poppler 20.12.1 Remote DoS via FoFiType1C::cvtGlyph (crafted PDF) An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.	Poppler
CVE-2020-36024	Aug 11, 2023	Poppler 20.12.1 DoS via FoFiType1C::convertToType1 An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.	Poppler
CVE-2023-34872	Jul 31, 2023	Outline.cc Poppler <23.06.0 DoS via crafted PDF (OutlineItem::open) A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.	Poppler
CVE-2023-34969	Jun 08, 2023	D-Bus dbus-daemon DoS via unreplyable message <1.15.6 D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.	Dbus
CVE-2022-4055	Nov 19, 2022	xdg-mail Improper URL Header Parsing Enables Unsafe Thunderbird Attachments When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.	Xdg Utils
CVE-2022-42010	Oct 10, 2022	D-Bus Crash via Invalid Type Signatures (<=1.12.24,1.13.x,<1.14.4,1.15.x<1.15.2) An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.	Dbus
CVE-2022-42011	Oct 10, 2022	CVE-2022-42011: Auth Crash in dbus-daemon/libdbus before 1.12.24/1.14.4/1.15.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.	Dbus
CVE-2022-42012	Oct 10, 2022	D-Bus <1.12.24 / 1.13.x / 1.14.x<1.14.4 / 1.15.x<1.15.2 Crash via Malformed FD An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.	Dbus
CVE-2022-38784	Aug 30, 2022	Poppler <=22.08.0 Integer Overflow in JBIG2 Decoder Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.	Poppler
CVE-2022-38171	Aug 22, 2022	CVE-2022-38171: Xpdf <=4.04 JBIG2 int overflow leading to code exec Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).	Poppler
CVE-2022-31782	Jun 02, 2022	ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.	Freetype Demo Programs
CVE-2022-1215	Jun 02, 2022	A format string vulnerability was found in libinput A format string vulnerability was found in libinput	Libinput
CVE-2022-27337	May 05, 2022	A logic error in the Hints::Hints function of Poppler v22.03.0 A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.	Poppler
CVE-2021-30860	Aug 24, 2021	An integer overflow was addressed with improved input validation An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.	Poppler
CVE-2021-33910	Jul 20, 2021	basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.	Systemd
CVE-2015-1877	Jun 02, 2021	The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.	Xdg Utils
CVE-2020-27748	Jun 01, 2021	A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.	Xdg Utils
CVE-2020-13529	May 10, 2021	An exploitable denial-of-service vulnerability exists in Systemd 245 An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.	Systemd
CVE-2021-3185	Jan 26, 2021	A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.	Gst Plugins Bad
CVE-2020-35702	Dec 25, 2020	DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects	Poppler
CVE-2020-27778	Dec 03, 2020	A flaw was found in Poppler in the way certain PDF files were converted into HTML A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.	Poppler
CVE-2020-16127	Nov 11, 2020	An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.	Accountsservice
CVE-2020-16126	Nov 11, 2020	An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.	Accountsservice
CVE-2020-16122	Nov 07, 2020	PackageKit's apt backend mistakenly treated all local debs as trusted PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.	Packagekit
CVE-2020-12049	Jun 08, 2020	An issue was discovered in dbus >= 1.3.0 before 1.12.18 An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.	Dbus
CVE-2020-13776	Jun 03, 2020	systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.	Systemd
CVE-2020-1712	Mar 31, 2020	A heap use-after-free vulnerability was found in systemd before version v245-rc1 A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.	Systemd
CVE-2019-20386	Jan 21, 2020	An issue was discovered in button_open in login/logind-button.c in systemd before 243 An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.	Systemd
CVE-2019-20367	Jan 08, 2020	nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).	Libbsd
CVE-2010-4653	Nov 13, 2019	An integer overflow condition in poppler before 0.16.3 An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.	Poppler
CVE-2018-21029	Oct 30, 2019	systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)	Systemd
CVE-2018-21009	Sep 05, 2019	Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.	Poppler
CVE-2019-15718	Sep 04, 2019	In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.	Systemd
CVE-2019-14494	Aug 01, 2019	An issue was discovered in Poppler through 0.78.0 An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.	Poppler
CVE-2019-9959	Jul 22, 2019	The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.	Poppler
CVE-2019-12749	Jun 11, 2019	dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon) dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.	Dbus
CVE-2019-12293	May 23, 2019	In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.	Poppler