The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary index is encountered, which allows an attacker to launch a denial of service attack.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-poppler | Jan 9, 2018 | Oct 1, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-app-text-poppler | Apr 9, 2018 | Oct 1, 2017 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-popplerhuawei-euleros-2_0_sp1-upgrade-poppler-glibhuawei-euleros-2_0_sp1-upgrade-poppler-qthuawei-euleros-2_0_sp1-upgrade-poppler-utils | Nov 30, 2017 | Oct 1, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-popplerhuawei-euleros-2_0_sp2-upgrade-poppler-glibhuawei-euleros-2_0_sp2-upgrade-poppler-qthuawei-euleros-2_0_sp2-upgrade-poppler-utils | Nov 30, 2017 | Oct 1, 2017 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-desktop-pdf-viewer-poppler-0-70-1-11-4-5-0-1-2-0 | Feb 20, 2019 | Oct 1, 2017 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Sep 14, 2017 | |
| Suse | — | suse-upgrade-libpoppler-cpp0suse-upgrade-libpoppler-develsuse-upgrade-libpoppler-glib-develsuse-upgrade-libpoppler-glib8suse-upgrade-libpoppler-qt4-4suse-upgrade-libpoppler-qt4-develsuse-upgrade-libpoppler60suse-upgrade-poppler-toolssuse-upgrade-typelib-1_0-poppler-0_18 | Jun 13, 2018 | Oct 1, 2017 |
| Ubuntu | ubuntu-upgrade-libpoppler44ubuntu-upgrade-libpoppler58ubuntu-upgrade-libpoppler64ubuntu-upgrade-libpoppler68ubuntu-upgrade-poppler-utils | Jan 9, 2018 | Oct 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub