Description
poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.18.4-6 | — |
| Debian 13 | poppler | 0.18.4-6 | — |
| Debian 12 | poppler | 0.18.4-6 | — |
| Debian 6.0 | poppler | 0.12.4-1.2+squeeze3 | DSA-2719-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 0.49.0-1.1 | openSUSE-SU-2024:10360-1 |
Advisories 2
- DSA-2719-1 poppler - multiple issues Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10360-1 libpoppler-cpp0-0.49.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=957aa252912cde85d76c41e9710b33425a82b696
- FEDORA-2013-3457 vendor-advisory
- MDVSA-2013:143 vendor-advisory
- FEDORA-2013-3473 vendor-advisory
- USN-1785-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=917108
- http://j00ru.vexillium.org/?p=1507
- DSA-2719 vendor-advisory
- http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=0388837f01bc467045164f9ddaff787000a8caaa
- 52846 third-party-advisory
- [oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes mailing-list
- [oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes mailing-list
- http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=e14b6e9c13d35c9bd1e0c50906ace8e707816888
- http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=bbc2d8918fe234b7ef2c480eb148943922cc0959
- http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492