The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade poppler | Jul 30, 2024 | Jul 7, 2008 |
| Freebsd | — | Upgrade poppler | Dec 10, 2025 | Jul 9, 2008 |
| Gentoo Linux | — | Upgrade app-text/poppler. | Oct 30, 2017 | Jul 7, 2008 |
| Suse | — | Upgrade libpoppler-develUpgrade libpoppler-glib4Upgrade libpoppler5Upgrade libpoppler-cpp2Upgrade libpoppler-qt2Upgrade libpoppler-glib8Upgrade poppler-toolsUpgrade libpoppler157Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-qt6-develUpgrade libpoppler-cpp3Upgrade libpoppler148Upgrade libpoppler-qt4-3Upgrade libpoppler-glib-develUpgrade libpoppler-qt4-develUpgrade libpoppler-qt6-3Upgrade libpoppler-qt3-devel | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libpoppler2 | Nov 8, 2024 | Jul 7, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub