Debian Poppler vulnerabilities

CVE-2020-18839 [MEDIUM] CVE-2020-18839: poppler - Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows at... Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service. Scope: local bookworm: resolved (fixed in 0.85.0-2) bullseye: resolved (fixed in 0.85.0-2) forky: resolved (fixed in 0.85.0-2) sid: resolved (fixed in 0.85.0-2) trixie: resolved (fixed in 0.85.0-2)

CVE-2025-32365 [MEDIUM] CVE-2025-32365: poppler - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads... Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. Scope: local bookworm: resolved (fixed in 22.12.0-2+deb12u1) bullseye: resolved (fixed in 20.09.0-3.1+deb11u2) forky: resolved (fixed in 25.03.0-3) sid: resolved (fixed in 25.03.0-3) trixie: reso

CVE-2018-20650 [MEDIUM] CVE-2018-20650: poppler - A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to c... A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach. Scope: local bookworm: resolved (fixed in 0.85.0-2) bullseye: resolved (fixed in 0.85.0-2) forky: resolved (fixed in 0.85.0-2) sid: re

CVE-2018-19149 [MEDIUM] CVE-2018-19149: poppler - Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new ... Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment. Scope: local bookworm: resolved (fixed in 0.71.0-2) bullseye: resolved (fixed in 0.71.0-2) forky: resolved (fixed in 0.71.0-2) sid: resolved (fixed in 0.71.0-2) trixie: resolved (fixed in 0.71.0-2)

CVE-2018-19058 [MEDIUM] CVE-2018-19058: poppler - An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.... An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file. Scope: local bookworm: resolved (fixed in 0.85.0-2) bullseye: resolved (fixed in 0.85.0-2) forky: resolved (fixed in 0.85.0-2) sid: resolved (fixed in 0.85.0-2)

CVE-2018-19060 [MEDIUM] CVE-2018-19060: poppler - An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference i... An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path. Scope: local bookworm: resolved (fixed in 0.85.0-2) bullseye: resolved (fixed in 0.85.0-2) forky: resolved (fixed in 0

CVE-2022-27337 [MEDIUM] CVE-2022-27337: poppler - A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers ... A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. Scope: local bookworm: resolved (fixed in 22.08.0-2) bullseye: resolved (fixed in 20.09.0-3.1+deb11u1) forky: resolved (fixed in 22.08.0-2) sid: resolved (fixed in 22.08.0-2) trixie: resolved (fixed in 22.08.0-2)

CVE-2020-36023 [MEDIUM] CVE-2020-36023: poppler - An issue was discovered in freedesktop poppler version 20.12.1, allows remote at... An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. Scope: local bookworm: resolved (fixed in 22.08.0-2) bullseye: resolved (fixed in 20.09.0-3.1+deb11u2) forky: resolved (fixed in 22.08.0-2) sid: resolved (fixed in 22.08.0-2) trixie: reso

CVE-2018-18897 [MEDIUM] CVE-2018-18897: poppler - An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpa... An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo. Scope: local bookworm: resolved (fixed in 0.85.0-2) bullseye: resolved (fixed in 0.85.0-2) forky: resolved (fixed in 0.85.0-2) sid: resolved (fixed in 0.85.0-2) trixie: resolved (fixed in 0.85.0-2)

CVE-2019-11026 [MEDIUM] CVE-2019-11026: poppler - FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursi... FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. Scope: local bookworm: resolved (fixed in 0.85.0-2) bullseye: resolved (fixed in 0.85.0-2) forky: resolved (fixed in 0.85.0-2) sid: resolved (fixed in 0.85.0-2) trixie: resolved (fixed in 0.85.0-2)

CVE-2022-37052 [MEDIUM] CVE-2022-37052: poppler - A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to c... A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. Scope: local bookworm: resolved (fixed in 22.08.0-2) bullseye: resolved (fixed in 20.09.0-3.1+deb11u2) forky: resolved (fixed in 22.08.0-2) sid: resolved (fixed in 22.08.0-2) trixie: resolved (fixed in 22.08.0-2)

CVE-2025-50420 [MEDIUM] CVE-2025-50420: poppler - An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attac... An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS). Scope: local bookworm: open bullseye: open forky: resolved (fixed in 25.03.0-6) sid: resolved (fixed in 25.03.0-6) trixie: resolved (fixed in 25.03.0-5+deb13u2)

CVE-2018-20662 [MEDIUM] CVE-2018-20662: poppler - In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial... In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. Scope: local bookworm: resolved (fixed in 0.71.0-4) bullseye: resolve

CVE-2018-20551 [MEDIUM] CVE-2018-20551: poppler - A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to ca... A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c. Scope: local bookworm: resolved (fixed in 0.71.0-4) bullseye: resolved (fixed in 0.71.0-4) forky: resolved (fixed in 0.71.0-4) sid: resolved (fixed in 0.71.0-4) t

CVE-2017-9408 [MEDIUM] CVE-2017-9408: poppler - In Poppler 0.54.0, a memory leak vulnerability was found in the function Object:... In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file. Scope: local bookworm: resolved (fixed in 0.57.0-2) bullseye: resolved (fixed in 0.57.0-2) forky: resolved (fixed in 0.57.0-2) sid: resolved (fixed in 0.57.0-2) trixie: resolved (fixed in 0.5

CVE-2017-9406 [MEDIUM] CVE-2017-9406: poppler - In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc... In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file. Scope: local bookworm: resolved (fixed in 0.57.0-2) bullseye: resolved (fixed in 0.57.0-2) forky: resolved (fixed in 0.57.0-2) sid: resolved (fixed in 0.57.0-2) trixie: resolved (fixed in 0.57.0-2)

CVE-2011-1553 [MEDIUM] CVE-2011-1553: poppler - Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before ... Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764. Scope: local bookworm: resolved bullseye:

CVE-2017-9865 [MEDIUM] CVE-2017-9865: poppler - The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows r... The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc. Scope: local bookworm: resolved (fixed in 0.57.0-2) bullseye: resolved (fixed in 0.57.0-2) forky: re

CVE-2011-1552 [MEDIUM] CVE-2011-1552: poppler - t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other produc... t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resol

CVE-2009-3609 [MEDIUM] CVE-2009-3609: poppler - Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf b... Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read. Scope: local bookworm: resolved