Skip to content
OpenAdvisories
Unscored USN-4042-1 12 CVEs

poppler vulnerabilities

Published Jun 27, 2019 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that poppler incorrectly handled certain files. If a user
or automated system were tricked into opening a crafted PDF file, an
attacker could cause a denial of service, or possibly execute arbitrary
code

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS poppler 0.41.0-0ubuntu1.14
Ubuntu · 18.04 LTS 18.04:LTS poppler 0.62.0-2ubuntu2.9

Vulnerabilities 12

  • Unscored —
    CVE-2017-9865

    The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of se…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2018-18897

    An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, a…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2018-20662

    In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused b…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2019-10018

    An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for th…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2019-10019

    An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc …

    poppler Ubuntu
  • Unscored —
    CVE-2019-10021

    An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nCom…

    poppler Ubuntu
  • Unscored —
    CVE-2019-10023

    An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for th…

    poppler Ubuntu
  • Unscored —
    CVE-2019-10872

    An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTranspare…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2019-12293

    In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2019-9200

    A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for ex…

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2019-9631

    Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2019-9903

    PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function…

    poppler poppler Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-9865
  • report
    https://ubuntu.com/security/CVE-2018-18897
  • report
    https://ubuntu.com/security/CVE-2018-20662
  • report
    https://ubuntu.com/security/CVE-2019-9200
  • report
    https://ubuntu.com/security/CVE-2019-9631
  • report
    https://ubuntu.com/security/CVE-2019-9903
  • report
    https://ubuntu.com/security/CVE-2019-10018
  • report
    https://ubuntu.com/security/CVE-2019-10019
  • report
    https://ubuntu.com/security/CVE-2019-10021
  • report
    https://ubuntu.com/security/CVE-2019-10023
  • report
    https://ubuntu.com/security/CVE-2019-10872
  • report
    https://ubuntu.com/security/CVE-2019-10873
  • report
    https://ubuntu.com/security/CVE-2019-12293