Description
Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.10.6-1 | — |
| Debian 13 | poppler | 0.10.6-1 | — |
| Debian 12 | poppler | 0.10.6-1 | — |
| Debian 5.0 | poppler | 0.8.7-3 | DSA-1941-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | poppler +2 | 0.5.4-4.4.el5_3.9 | RHSA-2009:0480 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 0.49.0-1.1 | openSUSE-SU-2024:10360-1 |
Advisories 3
- RHSA-2009:0480 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1941-1 poppler - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10360-1 libpoppler-cpp0-0.49.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://bugs.gentoo.org/show_bug.cgi?id=263028#c16
- https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/361875
- 35064 third-party-advisory
- FEDORA-2009-6972 vendor-advisory
- poppler-jbig2-cairooutputdev-code-excution(50184) vdb-entry
- 35618 third-party-advisory
- RHSA-2009:0480 vendor-advisory
- http://poppler.freedesktop.org/releases.html
- 34568 vdb-entry
- MDVSA-2011:175 vendor-advisory
- VU#196617 third-party-advisory
- ADV-2010-1040 vdb-entry
- FEDORA-2009-6982 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0059
- MDVSA-2010:087 vendor-advisory
- ADV-2009-1076 vdb-entry
- oval:org.mitre.oval:def:10292 vdb-entry signature
- 20090417 rPSA-2009-0059-1 poppler mailing-list
- FEDORA-2009-6973 vendor-advisory
- 34746 third-party-advisory