freedesktop Poppler 0.14.2

CPE Details

freedesktop Poppler 0.14.2
freedesktop
poppler
0.14.2
2013-04-12
12h24 +00:00
2013-04-12
12h24 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:freedesktop:poppler:0.14.2:*:*:*:*:*:*:*

Informations

Vendor

freedesktop

Product

poppler

Version

0.14.2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-6239 2024-06-21 13h28 +00:00 A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.
7.5
High
CVE-2023-34872 2023-07-30 22h00 +00:00 A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
5.5
Medium
CVE-2022-38784 2022-08-30 02h58 +00:00 Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
7.8
High
CVE-2022-38171 2022-08-22 18h33 +00:00 Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
7.8
High
CVE-2021-30860 2021-08-24 18h49 +00:00 An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
7.8
High
CVE-2020-27778 2020-12-03 15h46 +00:00 A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
7.5
High
CVE-2012-2142 2020-01-09 19h42 +00:00 The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.
7.8
High
CVE-2010-4654 2019-11-13 18h41 +00:00 poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
7.8
High
CVE-2010-4653 2019-11-13 18h12 +00:00 An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.
6.5
Medium
CVE-2018-21009 2019-09-05 01h24 +00:00 Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
8.8
High
CVE-2019-14494 2019-08-01 14h05 +00:00 An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
7.5
High
CVE-2019-9959 2019-07-22 12h18 +00:00 The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
6.5
Medium
CVE-2019-12293 2019-05-23 02h54 +00:00 In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
8.8
High
CVE-2018-19149 2018-11-10 18h00 +00:00 Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
6.5
Medium
CVE-2018-13988 2018-07-25 21h00 +00:00 Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
6.5
Medium
CVE-2017-18267 2018-05-10 13h00 +00:00 The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
5.5
Medium
CVE-2018-10768 2018-05-06 21h00 +00:00 There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.
6.5
Medium
CVE-2017-9775 2017-06-22 19h00 +00:00 Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.
6.5
Medium
CVE-2017-9776 2017-06-22 19h00 +00:00 Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
7.8
High
CVE-2017-7515 2017-06-06 12h00 +00:00 poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.
5.5
Medium
CVE-2013-4472 2014-04-22 12h00 +00:00 The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
3.3
CVE-2013-7296 2014-01-26 00h00 +00:00 The JBIG2Stream::readSegments method in JBIG2Stream.cc in Poppler before 0.24.5 does not use the correct specifier within a format string, which allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted PDF file.
5
CVE-2013-4473 2013-11-23 10h00 +00:00 Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.
7.5
CVE-2013-4474 2013-11-23 10h00 +00:00 Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.
5
CVE-2013-1789 2013-04-09 20h00 +00:00 splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1) Splash::arbitraryTransformMask, (2) Splash::blitMask, and (3) Splash::scaleMaskYuXu functions.
4.3
CVE-2013-1788 2013-04-09 18h00 +00:00 poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
6.8
CVE-2013-1790 2013-04-09 18h00 +00:00 poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function.
6.8
CVE-2010-3702 2010-11-05 16h00 +00:00 The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.
7.5