poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade poppler | Aug 30, 2017 | Apr 9, 2013 |
| Debian | — | Upgrade poppler | Jul 30, 2024 | Apr 9, 2013 |
| Gentoo Linux | — | Upgrade app-text/poppler. | Oct 30, 2017 | Apr 9, 2013 |
| Oracle Solaris | — | Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2Upgrade desktop/pdf-viewer/evince to version 2.30.3-0.175.1.10.0.4.0 on Solaris 11.1 | May 29, 2017 | Apr 9, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 10, 2013 |
| Suse | — | Upgrade poppler-qtUpgrade libpoppler-qt2Upgrade libpoppler-develUpgrade popplerUpgrade libpoppler-qt4-develUpgrade libpoppler-qt4-3Upgrade libpoppler-qt3-develUpgrade poppler-glibUpgrade libpoppler-glib-develUpgrade libpoppler5Upgrade sle-sdk-releaseUpgrade poppler-toolsUpgrade libpoppler-glib4Upgrade poppler-devel | Dec 12, 2013 | Apr 9, 2013 |
| Ubuntu | — | Upgrade libpoppler2Upgrade libpoppler-glib4Upgrade libpoppler5Upgrade libpoppler28Upgrade libpoppler-glib6Upgrade libpoppler13Upgrade libpoppler-glib8Upgrade libpoppler-glib2Upgrade libpoppler19 | Nov 8, 2024 | Apr 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub