PO
Product
poppler
28
CVEs
0
On KEV
6.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 1Low 0
Watch
Add poppler to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-52885 | 6.1 | Oct 10 | GHSL-2025-042: Poppler has Use-After-Free Affected: < 25.10.0 |
| CVE-2010-3704 | – | Nov 5 | The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly… Affected: 0.8.7; 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.10.0; +29 more |
| CVE-2010-3703 | – | Nov 5 | The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other… Affected: 0.8.7; 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.10.0; +29 more |
| CVE-2009-3938 | – | Nov 13 | Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword… Affected: 0.10.6; 0.12.0 |
| CVE-2009-3605 | – | Nov 2 | Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-3609 | – | Oct 21 | Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops,… Affected: through 0.12.0; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-3608 | – | Oct 21 | Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and… Affected: through 0.12.0; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-3607 | – | Oct 21 | Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption)… Affected: 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; 0.3.1; +34 more |
| CVE-2009-3606 | – | Oct 21 | Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary… Affected: 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; 0.3.1; +34 more |
| CVE-2009-3604 | – | Oct 21 | The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which… Affected: 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; 0.3.1; +34 more |
| CVE-2009-3603 | – | Oct 21 | Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a… Affected: through 0.12.0; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1188 | – | Apr 23 | Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1187 | – | Apr 23 | Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1183 | – | Apr 23 | The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1182 | – | Apr 23 | Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1181 | – | Apr 23 | The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1180 | – | Apr 23 | The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-1179 | – | Apr 23 | Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-0800 | – | Apr 23 | Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-0799 | – | Apr 23 | The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-0166 | – | Apr 23 | The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that… Affected: through 0.10.5; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +34 more |
| CVE-2009-0756 | – | Mar 3 | The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers a parsing error,… Affected: through 0.10.3; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +28 more |
| CVE-2009-0755 | – | Mar 3 | The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invalid Form Opt entry Affected: through 0.10.3; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +28 more |
| CVE-2008-2950 | – | Jul 7 | The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote… Affected: through 0.8.4 |
| CVE-2008-1693 | – | Apr 18 | The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle… Affected: through 0.7.3; 0.1; 0.1.1; 0.1.2; 0.2.0; 0.3.0; +23 more |
| CVE-2005-3625 | – | Dec 31 | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams… Affected: 0.4.2 |
| CVE-2005-3626 | – | Dec 31 | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted… Affected: 0.4.2 |
| CVE-2005-3624 | – | Dec 31 | The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via… Affected: 0.4.2 |
Showing 28