Priority MEDIUM 62
An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00374 · Published 2025-08-04 · No fix listed CWE-674
Priority LOW 25
Poppler is a PDF rendering library.
CVSS 4.0MEDIUM 5.5· Local · No auth · No interaction · EPSS 0.00446 · Published 2025-07-02 · Partial fix · 25.06.0 CWE-416
Priority LOW 19
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
CVSS 3.1MEDIUM 4.3· Local · No auth · No interaction · EPSS 0.00112 · Published 2025-04-18 · Partial fix · 25.04.0 CWE-347
Priority LOW 31
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00255 · Published 2025-04-05 · Partial fix · 25.04.0 CWE-125
Priority LOW 24
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00271 · Published 2025-04-05 · Partial fix · 25.04.0 CWE-190
Priority MEDIUM 53
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00624 · Published 2024-12-22 · Will not fix CWE-125
Priority LOW 34
A flaw was found in the Poppler's Pdfinfo utility.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00785 · Published 2024-06-21 · Partial fix · 20.11.0-12.el8_10, 21.01.0-21.el9 CWE-20
Priority MEDIUM 62
An issue was discovered in Poppler 22.08.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01063 · Published 2023-08-22 · Will not fix CWE-617
Priority MEDIUM 62
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01063 · Published 2023-08-22 · No fix listed CWE-617
Priority LOW 31
An issue was discovered in Poppler 22.07.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0113 · Published 2023-08-22 · No fix listed CWE-617
Priority MEDIUM 62
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog pro…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01085 · Published 2023-08-22 · No fix listed CWE-400
Priority LOW 35
Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01152 · Published 2023-08-22 · No fix listed CWE-674
Priority MEDIUM 62
Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00652 · Published 2023-08-22 · No fix listed CWE-787
Priority MEDIUM 58
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00532 · Published 2023-08-11 · Partial fix CWE-476
Priority MEDIUM 62
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01167 · Published 2023-08-11 · Will not fix CWE-835
Priority LOW 27
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00912 · Published 2023-07-31 · No fix listed CWE-400
Priority LOW 35
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc).
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00634 · Published 2022-08-30 · Partial fix CWE-190
Priority LOW 34
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc).
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00341 · Published 2022-08-22 · No fix listed CWE-190
Priority LOW 32
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.016 · Published 2022-05-05 · Partial fix
Priority CRITICAL 93KEV
An integer overflow was addressed with improved input validation.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.75994 · Published 2021-08-24 · Fixed in 11.6, 2021-005 +2 CWE-190
Priority LOW 36
DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00871 · Published 2020-12-25 · No fix listed CWE-787
Priority LOW 37
A flaw was found in Poppler in the way certain PDF files were converted into HTML.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01976 · Published 2020-12-03 · Partial fix CWE-824
Priority LOW 39
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.02942 · Published 2020-01-09 · Partial fix · 0.21.4
Priority LOW 36
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01161 · Published 2019-11-13 · Fixed in 0.16.3 CWE-74
Priority LOW 32
An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01822 · Published 2019-11-13 · Fixed in 0.16.3 CWE-190
Load more
THREATIST.IORead the docs