CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 09/01/2020 |
| CVE-2010-4654 | HIGH7.8 | poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack. | 13/11/2019 |
| CVE-2010-4653 | MEDIUM6.5 | An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts. | 13/11/2019 |
| CVE-2018-21009 | HIGH8.8 | Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. | 05/09/2019 |
| CVE-2019-14494 | HIGH7.5 | An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. | 01/08/2019 |
| CVE-2019-9959 | MEDIUM6.5 | The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo. | 22/07/2019 |
| CVE-2019-12293 | HIGH8.8 | In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. | 23/05/2019 |
| CVE-2019-11026 | MEDIUM6.5 | FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. | 08/04/2019 |
| CVE-2019-10873 | MEDIUM6.5 | An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc. | 05/04/2019 |
| CVE-2019-10872 | HIGH8.8 | An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc. | 05/04/2019 |
| CVE-2019-10871 | MEDIUM6.5 | An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. | 05/04/2019 |
| CVE-2019-9903 | MEDIUM6.5 | PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary. | 21/03/2019 |
| CVE-2019-9631 | CRITICAL9.8 | Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. | 08/03/2019 |
| CVE-2019-9545 | HIGH8.8 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other | 01/03/2019 |
| CVE-2019-9543 | HIGH8.8 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified | 01/03/2019 |
| CVE-2019-9200 | HIGH8.8 | A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. | 26/02/2019 |
| CVE-2019-7310 | HIGH7.8 | In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. | 03/02/2019 |
| CVE-2018-20662 | MEDIUM6.5 | In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. | 03/01/2019 |