Poppler FreeDesktop Poppler

Do you want an email whenever new security vulnerabilities are reported in FreeDesktop Poppler?

By the Year

In 2022 there have been 0 vulnerabilities in FreeDesktop Poppler . Poppler did not have any published security vulnerabilities last year.

Year Vulnerabilities Average Score
2022 0 0.00
2021 0 0.00
2020 1 7.50
2019 16 7.78
2018 11 6.41

It may take a day or so for new Poppler vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent FreeDesktop Poppler Security Vulnerabilities

A flaw was found in Poppler in the way certain PDF files were converted into HTML

CVE-2020-27778 7.5 - High - December 03, 2020

A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.

Access of Uninitialized Pointer

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

CVE-2018-21009 8.8 - High - September 05, 2019

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Integer Overflow or Wraparound

An issue was discovered in Poppler through 0.78.0

CVE-2019-14494 7.5 - High - August 01, 2019

An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.

Divide By Zero

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length

CVE-2019-9959 6.5 - Medium - July 22, 2019

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.

Integer Overflow or Wraparound

In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc

CVE-2019-12293 8.8 - High - May 23, 2019

In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.

Out-of-bounds Read

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion

CVE-2019-11026 6.5 - Medium - April 08, 2019

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.

Stack Exhaustion

An issue was discovered in Poppler 0.74.0

CVE-2019-10873 6.5 - Medium - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.

NULL Pointer Dereference

An issue was discovered in Poppler 0.74.0

CVE-2019-10872 8.8 - High - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.

Out-of-bounds Read

An issue was discovered in Poppler 0.74.0

CVE-2019-10871 6.5 - Medium - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.

Out-of-bounds Read

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc

CVE-2019-9903 6.5 - Medium - March 21, 2019

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

Memory Corruption

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

CVE-2019-9631 9.8 - Critical - March 08, 2019

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

Out-of-bounds Read

An issue was discovered in Poppler 0.74.0

CVE-2019-9545 8.8 - High - March 01, 2019

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

Improper Input Validation

An issue was discovered in Poppler 0.74.0

CVE-2019-9543 8.8 - High - March 01, 2019

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.

Improper Input Validation

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0

CVE-2019-9200 8.8 - High - February 26, 2019

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Memory Corruption

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc)

CVE-2019-7310 8.8 - High - February 03, 2019

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

Out-of-bounds Read

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc

CVE-2018-20662 6.5 - Medium - January 03, 2019

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.

Improper Input Validation

A reachable Object::dictLookup assertion in Poppler 0.72.0

CVE-2018-20650 6.5 - Medium - January 01, 2019

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.

Improper Input Validation

A reachable Object::getString assertion in Poppler 0.72.0

CVE-2018-20551 6.5 - Medium - December 28, 2018

A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.

Improper Input Validation

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which

CVE-2018-20481 6.5 - Medium - December 26, 2018

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.

NULL Pointer Dereference

Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called

CVE-2018-19149 6.5 - Medium - November 10, 2018

Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.

NULL Pointer Dereference

An issue was discovered in Poppler 0.71.0

CVE-2018-19058 6.5 - Medium - November 07, 2018

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

Always-Incorrect Control Flow Implementation

An issue was discovered in Poppler 0.71.0

CVE-2018-19060 6.5 - Medium - November 07, 2018

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.

NULL Pointer Dereference

An issue was discovered in Poppler 0.71.0

CVE-2018-19059 6.5 - Medium - November 07, 2018

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.

Out-of-bounds Read

An issue was discovered in Poppler 0.71.0

CVE-2018-18897 6.5 - Medium - November 02, 2018

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.

Missing Release of Resource after Effective Lifetime

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file

CVE-2018-16646 6.5 - Medium - September 06, 2018

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.

Infinite Loop

Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access

CVE-2018-13988 6.5 - Medium - July 25, 2018

Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.

Out-of-bounds Read

The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0

CVE-2017-18267 5.5 - Medium - May 10, 2018

The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.

Infinite Loop

There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5

CVE-2018-10768 6.5 - Medium - May 06, 2018

There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.

NULL Pointer Dereference

In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc

CVE-2017-14928 5.5 - Medium - September 30, 2017

In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document.

NULL Pointer Dereference

In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc

CVE-2017-14926 5.5 - Medium - September 30, 2017

In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.

NULL Pointer Dereference

The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors

CVE-2010-3702 - November 05, 2010

The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.

NULL Pointer Dereference

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file

CVE-2007-3387 - July 30, 2007

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

Integer Overflow or Wraparound

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Debian Linux or by FreeDesktop? Click the Watch button to subscribe.

FreeDesktop
Vendor

subscribe