Filtered by vendor Freedesktop Subscriptions
Total 135 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-11026 2 Fedoraproject, Freedesktop 2 Fedora, Poppler 2024-11-21 6.5 Medium
FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
CVE-2019-10873 1 Freedesktop 1 Poppler 2024-11-21 N/A
An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.
CVE-2019-10872 1 Freedesktop 1 Poppler 2024-11-21 N/A
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.
CVE-2019-10871 2 Freedesktop, Redhat 2 Poppler, Enterprise Linux 2024-11-21 N/A
An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.
CVE-2018-21009 2 Freedesktop, Redhat 2 Poppler, Enterprise Linux 2024-11-21 N/A
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
CVE-2018-20662 5 Canonical, Debian, Fedoraproject and 2 more 11 Ubuntu Linux, Debian Linux, Fedora and 8 more 2024-11-21 6.5 Medium
In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.
CVE-2018-20650 4 Canonical, Debian, Freedesktop and 1 more 10 Ubuntu Linux, Debian Linux, Poppler and 7 more 2024-11-21 6.5 Medium
A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
CVE-2018-20551 3 Canonical, Freedesktop, Redhat 3 Ubuntu Linux, Poppler, Enterprise Linux 2024-11-21 N/A
A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.
CVE-2018-20481 4 Canonical, Debian, Freedesktop and 1 more 4 Ubuntu Linux, Debian Linux, Poppler and 1 more 2024-11-21 N/A
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVE-2018-19149 3 Canonical, Freedesktop, Redhat 3 Ubuntu Linux, Poppler, Enterprise Linux 2024-11-21 N/A
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
CVE-2018-19060 3 Canonical, Freedesktop, Redhat 3 Ubuntu Linux, Poppler, Enterprise Linux 2024-11-21 N/A
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.
CVE-2018-19059 3 Canonical, Freedesktop, Redhat 3 Ubuntu Linux, Poppler, Enterprise Linux 2024-11-21 N/A
An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
CVE-2018-19058 4 Canonical, Debian, Freedesktop and 1 more 7 Ubuntu Linux, Debian Linux, Poppler and 4 more 2024-11-21 6.5 Medium
An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
CVE-2018-18897 4 Canonical, Debian, Freedesktop and 1 more 10 Ubuntu Linux, Debian Linux, Poppler and 7 more 2024-11-21 6.5 Medium
An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.
CVE-2018-17336 3 Canonical, Freedesktop, Redhat 3 Ubuntu Linux, Udisks, Enterprise Linux 2024-11-21 N/A
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.
CVE-2018-16646 4 Canonical, Debian, Freedesktop and 1 more 4 Ubuntu Linux, Debian Linux, Poppler and 1 more 2024-11-21 N/A
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.
CVE-2018-14036 2 Freedesktop, Redhat 2 Accountsservice, Enterprise Linux 2024-11-21 N/A
Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
CVE-2018-13988 4 Canonical, Debian, Freedesktop and 1 more 9 Ubuntu Linux, Debian Linux, Poppler and 6 more 2024-11-21 N/A
Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
CVE-2018-10768 4 Canonical, Debian, Freedesktop and 1 more 8 Ubuntu Linux, Debian Linux, Poppler and 5 more 2024-11-21 N/A
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.
CVE-2017-9865 2 Debian, Freedesktop 2 Debian Linux, Poppler 2024-11-21 N/A
The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc.