Description
poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.18.4-6 | — |
| Debian 13 | poppler | 0.18.4-6 | — |
| Debian 12 | poppler | 0.18.4-6 | — |
| Debian 6.0 | poppler | 0.12.4-1.2+squeeze3 | DSA-2719-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 0.49.0-1.1 | openSUSE-SU-2024:10360-1 |
Advisories 2
- DSA-2719-1 poppler - multiple issues Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10360-1 libpoppler-cpp0-0.49.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2013-3457 vendor-advisory
- MDVSA-2013:143 vendor-advisory
- FEDORA-2013-3473 vendor-advisory
- USN-1785-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=917111
- http://j00ru.vexillium.org/?p=1507
- DSA-2719 vendor-advisory
- http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=b1026b5978c385328f2a15a2185c599a563edf91
- 52846 third-party-advisory
- [oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes mailing-list
- [oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes mailing-list