FreeDesktop

Poppler: Out-of-Bounds Read in JBIG2Bitmap::combine Function

CVE-2024-56378 - December 23, 2024

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

A flaw was found in the Poppler's Pdfinfo utility

CVE-2024-6239 7.5 - High - June 21, 2024

A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c c

CVE-2022-37050 6.5 - Medium - August 22, 2023

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.

An issue was discovered in Poppler 22.08.0

CVE-2022-38349 6.5 - Medium - August 22, 2023

An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.

assertion failure

An issue was discovered in Poppler 22.07.0

CVE-2022-37051 6.5 - Medium - August 22, 2023

An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.

assertion failure

A reachable Object::getString assertion in Poppler 22.07.0

CVE-2022-37052 6.5 - Medium - August 22, 2023

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.

assertion failure

Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0

CVE-2020-23804 7.5 - High - August 22, 2023

Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.

Stack Exhaustion

Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0

CVE-2020-18839 6.5 - Medium - August 22, 2023

Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.

Memory Corruption

An issue was discovered in freedesktop poppler version 20.12.1

CVE-2020-36023 6.5 - Medium - August 11, 2023

An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.

Infinite Loop

An issue was discovered in freedesktop poppler version 20.12.1

CVE-2020-36024 5.5 - Medium - August 11, 2023

An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.

NULL Pointer Dereference

A vulnerability in Outline.cc for Poppler prior to 23.06.0

CVE-2023-34872 5.5 - Medium - July 31, 2023

A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon

CVE-2023-34969 6.5 - Medium - June 08, 2023

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird

CVE-2022-4055 7.4 - High - November 19, 2022

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Improper Neutralization of Expression/Command Delimiters

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2

CVE-2022-42010 6.5 - Medium - October 10, 2022

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.

Improper Verification of Cryptographic Signature

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2

CVE-2022-42011 6.5 - Medium - October 10, 2022

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.

out-of-bounds array index

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2

CVE-2022-42012 6.5 - Medium - October 10, 2022

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc)

CVE-2022-38784 7.8 - High - August 30, 2022

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.

Integer Overflow or Wraparound

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc)

CVE-2022-38171 7.8 - High - August 22, 2022

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

Integer Overflow or Wraparound

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

CVE-2022-31782 7.8 - High - June 02, 2022

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Memory Corruption

A format string vulnerability was found in libinput

CVE-2022-1215 7.8 - High - June 02, 2022

A format string vulnerability was found in libinput

Use of Externally-Controlled Format String

A logic error in the Hints::Hints function of Poppler v22.03.0

CVE-2022-27337 6.5 - Medium - May 05, 2022

A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

An integer overflow was addressed with improved input validation

CVE-2021-30860 7.8 - High - August 24, 2021

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Integer Overflow or Wraparound

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker)

CVE-2021-33910 5.5 - Medium - July 20, 2021

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

Allocation of Resources Without Limits or Throttling

The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which

CVE-2015-1877 8.8 - High - June 02, 2021

The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.

Command Injection

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer

CVE-2020-27748 6.5 - Medium - June 01, 2021

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.

Insertion of Sensitive Information Into Sent Data

An exploitable denial-of-service vulnerability exists in Systemd 245

CVE-2020-13529 6.1 - Medium - May 10, 2021

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

Authentication Bypass by Spoofing

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header

CVE-2021-3185 9.8 - Critical - January 26, 2021

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.

Memory Corruption

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document

CVE-2020-35702 7.8 - High - December 25, 2020

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects

Memory Corruption

A flaw was found in Poppler in the way certain PDF files were converted into HTML

CVE-2020-27778 7.5 - High - December 03, 2020

A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.

Access of Uninitialized Pointer

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files

CVE-2020-16127 5.5 - Medium - November 11, 2020

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.

Infinite Loop

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid

CVE-2020-16126 3.3 - Low - November 11, 2020

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.

PackageKit's apt backend mistakenly treated all local debs as trusted

CVE-2020-16122 7.8 - High - November 07, 2020

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

Insufficient Verification of Data Authenticity

An issue was discovered in dbus >= 1.3.0 before 1.12.18

CVE-2020-12049 5.5 - Medium - June 08, 2020

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

Improper Resource Shutdown or Release

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits

CVE-2020-13776 6.7 - Medium - June 03, 2020

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Improper Privilege Management

A heap use-after-free vulnerability was found in systemd before version v245-rc1

CVE-2020-1712 7.8 - High - March 31, 2020

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

Dangling pointer

An issue was discovered in button_open in login/logind-button.c in systemd before 243

CVE-2019-20386 2.4 - Low - January 21, 2020

An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.

Memory Leak

nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name

CVE-2019-20367 9.1 - Critical - January 08, 2020

nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).

Out-of-bounds Read

An integer overflow condition in poppler before 0.16.3

CVE-2010-4653 6.5 - Medium - November 13, 2019

An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.

Integer Overflow or Wraparound

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS

CVE-2018-21029 9.8 - Critical - October 30, 2019

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)

Improper Certificate Validation

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

CVE-2018-21009 8.8 - High - September 05, 2019

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Integer Overflow or Wraparound

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted

CVE-2019-15718 4.4 - Medium - September 04, 2019

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.

An issue was discovered in Poppler through 0.78.0

CVE-2019-14494 7.5 - High - August 01, 2019

An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.

Divide By Zero

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length

CVE-2019-9959 6.5 - Medium - July 22, 2019

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.

Integer Overflow or Wraparound

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon)

CVE-2019-12749 7.1 - High - June 11, 2019

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.

insecure temporary file

In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc

CVE-2019-12293 8.8 - High - May 23, 2019

In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.

Out-of-bounds Read

systemd 242 changes the VT1 mode upon a logout, which

CVE-2018-20839 4.3 - Medium - May 17, 2019

systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

Information Disclosure

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be

CVE-2019-3843 7.8 - High - April 26, 2019

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

Improper Privilege Management

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would

CVE-2019-3844 7.8 - High - April 26, 2019

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

Privilege Chaining

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion

CVE-2019-11026 6.5 - Medium - April 08, 2019

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.

Stack Exhaustion

An issue was discovered in Poppler 0.74.0

CVE-2019-10871 6.5 - Medium - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.

Out-of-bounds Read