Vulnerabilities > Freedesktop > Poppler > High

DATE CVE VULNERABILITY TITLE RISK
2019-02-26 CVE-2019-9200 Out-of-bounds Write vulnerability in multiple products
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary.
network
low complexity
freedesktop debian canonical CWE-787
8.8
8.8
2019-02-03 CVE-2019-7310 Incorrect Conversion between Numeric Types vulnerability in multiple products
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. 		7.8
7.8
2017-07-12 CVE-2017-2820 Integer Overflow or Wraparound vulnerability in Freedesktop Poppler 0.53.0
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0.
network
low complexity
freedesktop CWE-190
8.8
8.8
2013-11-23 CVE-2013-4473 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.
network
low complexity
freedesktop canonical CWE-119
7.5
7.5
2010-11-05 CVE-2010-3702 Null Pointer Dereference vulnerability in multiple products
The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference. 		7.5
7.5