FreeDesktop
Products by FreeDesktop Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2024 there have been 0 vulnerabilities in FreeDesktop . Last year FreeDesktop had 10 security vulnerabilities published. Right now, FreeDesktop is on track to have less security vulnerabilities in 2024 than it did last year.
Year | Vulnerabilities | Average Score |
---|---|---|
2024 | 0 | 0.00 |
2023 | 10 | 6.40 |
2022 | 9 | 7.18 |
2021 | 6 | 7.42 |
2020 | 10 | 6.34 |
2019 | 28 | 7.35 |
2018 | 21 | 6.82 |
It may take a day or so for new FreeDesktop vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent FreeDesktop Security Vulnerabilities
Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0
CVE-2020-23804
7.5 - High
- August 22, 2023
Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.
Stack Exhaustion
A reachable Object::getString assertion in Poppler 22.07.0
CVE-2022-37052
6.5 - Medium
- August 22, 2023
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
assertion failure
An issue was discovered in Poppler 22.07.0
CVE-2022-37051
6.5 - Medium
- August 22, 2023
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
assertion failure
An issue was discovered in Poppler 22.08.0
CVE-2022-38349
6.5 - Medium
- August 22, 2023
An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.
assertion failure
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c c
CVE-2022-37050
6.5 - Medium
- August 22, 2023
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0
CVE-2020-18839
6.5 - Medium
- August 22, 2023
Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.
Memory Corruption
An issue was discovered in freedesktop poppler version 20.12.1
CVE-2020-36024
5.5 - Medium
- August 11, 2023
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.
NULL Pointer Dereference
An issue was discovered in freedesktop poppler version 20.12.1
CVE-2020-36023
6.5 - Medium
- August 11, 2023
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
Infinite Loop
A vulnerability in Outline.cc for Poppler prior to 23.06.0
CVE-2023-34872
5.5 - Medium
- July 31, 2023
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon
CVE-2023-34969
6.5 - Medium
- June 08, 2023
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird
CVE-2022-4055
7.4 - High
- November 19, 2022
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Improper Neutralization of Expression/Command Delimiters
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2
CVE-2022-42012
6.5 - Medium
- October 10, 2022
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2
CVE-2022-42011
6.5 - Medium
- October 10, 2022
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.
out-of-bounds array index
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2
CVE-2022-42010
6.5 - Medium
- October 10, 2022
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.
Improper Verification of Cryptographic Signature
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc)
CVE-2022-38784
7.8 - High
- August 30, 2022
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
Integer Overflow or Wraparound
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc)
CVE-2022-38171
7.8 - High
- August 22, 2022
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
Integer Overflow or Wraparound
A format string vulnerability was found in libinput
CVE-2022-1215
7.8 - High
- June 02, 2022
A format string vulnerability was found in libinput
Use of Externally-Controlled Format String
ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.
CVE-2022-31782
7.8 - High
- June 02, 2022
ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.
Memory Corruption
A logic error in the Hints::Hints function of Poppler v22.03.0
CVE-2022-27337
6.5 - Medium
- May 05, 2022
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
An integer overflow was addressed with improved input validation
CVE-2021-30860
7.8 - High
- August 24, 2021
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Integer Overflow or Wraparound
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker)
CVE-2021-33910
5.5 - Medium
- July 20, 2021
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
Allocation of Resources Without Limits or Throttling
The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which
CVE-2015-1877
8.8 - High
- June 02, 2021
The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.
Command Injection
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer
CVE-2020-27748
6.5 - Medium
- June 01, 2021
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
Insertion of Sensitive Information Into Sent Data
An exploitable denial-of-service vulnerability exists in Systemd 245
CVE-2020-13529
6.1 - Medium
- May 10, 2021
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
Authentication Bypass by Spoofing
A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header
CVE-2021-3185
9.8 - Critical
- January 26, 2021
A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.
Memory Corruption
DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document
CVE-2020-35702
7.8 - High
- December 25, 2020
DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects
Memory Corruption
A flaw was found in Poppler in the way certain PDF files were converted into HTML
CVE-2020-27778
7.5 - High
- December 03, 2020
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
Access of Uninitialized Pointer
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid
CVE-2020-16126
3.3 - Low
- November 11, 2020
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files
CVE-2020-16127
5.5 - Medium
- November 11, 2020
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.
Infinite Loop
PackageKit's apt backend mistakenly treated all local debs as trusted
CVE-2020-16122
7.8 - High
- November 07, 2020
PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.
Insufficient Verification of Data Authenticity
An issue was discovered in dbus >= 1.3.0 before 1.12.18
CVE-2020-12049
5.5 - Medium
- June 08, 2020
An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.
Improper Resource Shutdown or Release
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits
CVE-2020-13776
6.7 - Medium
- June 03, 2020
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Improper Privilege Management
A heap use-after-free vulnerability was found in systemd before version v245-rc1
CVE-2020-1712
7.8 - High
- March 31, 2020
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Dangling pointer
An issue was discovered in button_open in login/logind-button.c in systemd before 243
CVE-2019-20386
2.4 - Low
- January 21, 2020
An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
Memory Leak
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name
CVE-2019-20367
9.1 - Critical
- January 08, 2020
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
Out-of-bounds Read
An integer overflow condition in poppler before 0.16.3
CVE-2010-4653
6.5 - Medium
- November 13, 2019
An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.
Integer Overflow or Wraparound
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS
CVE-2018-21029
9.8 - Critical
- October 30, 2019
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)
Improper Certificate Validation
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
CVE-2018-21009
8.8 - High
- September 05, 2019
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
Integer Overflow or Wraparound
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted
CVE-2019-15718
4.4 - Medium
- September 04, 2019
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
An issue was discovered in Poppler through 0.78.0
CVE-2019-14494
7.5 - High
- August 01, 2019
An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
Divide By Zero
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length
CVE-2019-9959
6.5 - Medium
- July 22, 2019
The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
Integer Overflow or Wraparound
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon)
CVE-2019-12749
7.1 - High
- June 11, 2019
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
insecure temporary file
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc
CVE-2019-12293
8.8 - High
- May 23, 2019
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
Out-of-bounds Read
systemd 242 changes the VT1 mode upon a logout, which
CVE-2018-20839
9.8 - Critical
- May 17, 2019
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Information Disclosure
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be
CVE-2019-3843
7.8 - High
- April 26, 2019
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.
Improper Privilege Management
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would
CVE-2019-3844
7.8 - High
- April 26, 2019
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
Privilege Chaining
FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion
CVE-2019-11026
6.5 - Medium
- April 08, 2019
FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
Stack Exhaustion
An issue was discovered in Poppler 0.74.0
CVE-2019-10871
6.5 - Medium
- April 05, 2019
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.
Out-of-bounds Read
An issue was discovered in Poppler 0.74.0
CVE-2019-10872
8.8 - High
- April 05, 2019
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.
Out-of-bounds Read
An issue was discovered in Poppler 0.74.0
CVE-2019-10873
6.5 - Medium
- April 05, 2019
An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.
NULL Pointer Dereference
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc
CVE-2019-9903
6.5 - Medium
- March 21, 2019
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
Memory Corruption
An issue was discovered in sd-bus in systemd 239
CVE-2019-6454
5.5 - Medium
- March 21, 2019
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).
Memory Corruption
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.
CVE-2019-9631
9.8 - Critical
- March 08, 2019
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.
Out-of-bounds Read
An issue was discovered in Poppler 0.74.0
CVE-2019-9543
8.8 - High
- March 01, 2019
An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
Improper Input Validation
An issue was discovered in Poppler 0.74.0
CVE-2019-9545
8.8 - High
- March 01, 2019
An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
Improper Input Validation
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0
CVE-2019-9200
8.8 - High
- February 26, 2019
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Memory Corruption
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc)
CVE-2019-7310
7.8 - High
- February 03, 2019
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
Out-of-bounds Read
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes
CVE-2018-16888
4.7 - Medium
- January 14, 2019
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
Improper Privilege Management
An allocation of memory without limits
CVE-2018-16865
7.8 - High
- January 11, 2019
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
Allocation of Resources Without Limits or Throttling
An allocation of memory without limits
CVE-2018-16864
7.8 - High
- January 11, 2019
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
Allocation of Resources Without Limits or Throttling
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'
CVE-2018-16866
3.3 - Low
- January 11, 2019
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
Information Disclosure
In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc
CVE-2018-20662
6.5 - Medium
- January 03, 2019
In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.
Improper Input Validation
A reachable Object::dictLookup assertion in Poppler 0.72.0
CVE-2018-20650
6.5 - Medium
- January 01, 2019
A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
Improper Input Validation
A reachable Object::getString assertion in Poppler 0.72.0
CVE-2018-20551
6.5 - Medium
- December 28, 2018
A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.
Improper Input Validation
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which
CVE-2018-20481
6.5 - Medium
- December 26, 2018
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
NULL Pointer Dereference
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called
CVE-2018-19149
6.5 - Medium
- November 10, 2018
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
NULL Pointer Dereference
An issue was discovered in Poppler 0.71.0
CVE-2018-19058
6.5 - Medium
- November 07, 2018
An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
Always-Incorrect Control Flow Implementation
An issue was discovered in Poppler 0.71.0
CVE-2018-19059
6.5 - Medium
- November 07, 2018
An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
Out-of-bounds Read
An issue was discovered in Poppler 0.71.0
CVE-2018-19060
6.5 - Medium
- November 07, 2018
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.
NULL Pointer Dereference
An issue was discovered in Poppler 0.71.0
CVE-2018-18897
6.5 - Medium
- November 02, 2018
An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.
Missing Release of Resource after Effective Lifetime
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess
CVE-2018-15686
7.8 - High
- October 26, 2018
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
Marshaling, Unmarshaling
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files
CVE-2018-15687
7 - High
- October 26, 2018
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
Race Condition
A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd
CVE-2018-15688
8.8 - High
- October 26, 2018
A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
Classic Buffer Overflow
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c
CVE-2018-17336
7.8 - High
- September 22, 2018
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.
Use of Externally-Controlled Format String
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file
CVE-2018-16646
6.5 - Medium
- September 06, 2018
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.
Infinite Loop
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys
CVE-2017-2626
5.5 - Medium
- July 27, 2018
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.
Insufficient Entropy
Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access
CVE-2018-13988
6.5 - Medium
- July 25, 2018
Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
Out-of-bounds Read
Directory Traversal with
CVE-2018-14036
6.5 - Medium
- July 13, 2018
Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
Directory traversal
The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0
CVE-2017-18267
5.5 - Medium
- May 10, 2018
The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
Infinite Loop
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5
CVE-2018-10768
6.5 - Medium
- May 06, 2018
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.
NULL Pointer Dereference
In systemd prior to 234 a race condition exists between .mount and .automount units such
CVE-2018-1049
5.9 - Medium
- February 16, 2018
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.
Race Condition
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under
CVE-2018-6954
7.8 - High
- February 13, 2018
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.
insecure temporary file
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which
CVE-2017-18078
7.8 - High
- January 29, 2018
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
insecure temporary file
It was found that system umask policy is not being honored when creating XDG user directories
CVE-2017-15131
7.8 - High
- January 09, 2018
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
Authorization
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc
CVE-2017-14926
5.5 - Medium
- September 30, 2017
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.
NULL Pointer Dereference
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc
CVE-2017-14928
5.5 - Medium
- September 30, 2017
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document.
NULL Pointer Dereference
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0
CVE-2017-2820
8.8 - High
- July 12, 2017
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library.
Integer Overflow or Wraparound
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0
CVE-2017-2818
8.8 - High
- July 12, 2017
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption. An attacker controlled PDF file can be used to trigger this vulnerability.
Buffer Overflow
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0
CVE-2017-2814
8.8 - High
- July 12, 2017
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker controlled PDF file can be used to trigger this vulnerability.
Buffer Overflow
pkexec, when used with --user nonpriv
CVE-2016-2568
7.8 - High
- February 13, 2017
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Output Sanitization
Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2
CVE-2016-2090
9.8 - Critical
- January 13, 2017
Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow.
Buffer Overflow
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which
CVE-2015-0245
- February 13, 2015
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Race Condition
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2
CVE-2014-7824
- November 18, 2014
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
Resource Management Errors
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages
CVE-2014-3636
- October 25, 2014
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.
Resource Management Errors
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which
CVE-2014-3639
- September 22, 2014
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
Resource Management Errors
The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8
CVE-2014-3638
- September 22, 2014
The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
Resource Management Errors
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes
CVE-2014-3637
- September 22, 2014
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.
DEPRECATED: Code
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number
CVE-2014-3635
- September 22, 2014
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
Buffer Overflow
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages
CVE-2014-3533
- July 19, 2014
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.
Improper Input Validation
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which
CVE-2014-3477
- July 01, 2014
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.