3969 matches found
CVE-2025-50422
Poppler 25.04.0 이전 버전 pdftocairo가 악성 PDF를 렌더링하고 종료 시 cairodebugresetstaticdata를 호출하면 PDF 객체 스트림을 포함하는 힙 메모리가 제대로 지워지지 않습니다. 로컬 액세스 권한이 있는 공격자는 프로세스 메모리를 덤프하여 평문 PDF 콘텐츠예: /stream /endstream 블록를 복구할 수 있습니다. 구체적인 취약점 재현 과정Cause of the vulnerability.pdf 및 POC 파일poppler-pdftocairo-poc이 첨부되어 있습니다...
CVE-2025-50420
Poppler 25.07.0 이전 버전에는 pdfseparate 유틸리티의 PDFDoc 처리 로직에 취약점이 존재합니다. 제작된 "/Annots" 사전이 자기 자신 또는 서로를 참조하면 "PDFDoc::markAnnotations -- PDFDoc::markPageObjects -- PDFDoc::markObject -- PDFDoc::markDictionary"에서 무한 재귀가 발생합니다. 루프 감지는 각 fetch에서 사전 포인터 주소가 다르기 때문에 실패합니다. 원격 공격자는 악성 PDF를 처리하여 서비스 거부애플리케이션...
poppler: poppler: Data corruption via integer overflow in FoFiTrueType::cvtSfnts
A flaw was found in Poppler. An integer overflow vulnerability in the TrueType font handling code can allow a local user to cause data corruption. By providing a specially crafted font file processed by the FoFiTrueType::cvtSfnts function, an attacker can cause improper data modification and...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: poppler: poppler-26.08.0-1.2.hum1 aarch64, x8664 poppler-cpp-26.08.0-1.2.hum1 aarch64, x8664 poppler-cpp-devel-26.08.0-1.2.hum1 aarch64, x8664 poppler-devel-26.08.0-1.2.hum1 aarch64, x8664...
poppler: poppler: Denial of Service via integer overflow in SplashClip
A flaw was found in poppler. An integer overflow vulnerability exists in the SplashClip rendering component when handling path clipping operations. A local attacker could exploit this flaw by providing specially crafted input, causing the application to crash and resulting in a Denial of Service...
Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1781354122)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781354122 advisory. - A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that,...
Rocky Linux 9 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2024_9167)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249167 advisory. poppler: pdfinfo: crash in broken documents when using -dests parameter CVE-2024-6239 Tenable has extracted the preceding description block directly from the CIQ...
Rocky Linux 8 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2023_2810)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20232810 advisory. poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 Tenable has extracted the preceding description block directly from the CIQ security...
Rocky Linux 10.2 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2026_24985)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624985 advisory. poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication CVE-2026-10118...
Rocky Linux 8 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2026_0130)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260130 advisory. poppler: Out-of-Bounds Read in Poppler CVE-2025-32365 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessu...
CentOS Linux 7 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-demos / etc (CENTOS7:CLSA-2025:1763139862)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1763139862 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because...
Rocky Linux 10.1 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2026_0128)
The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260128 advisory. poppler: Out-of-Bounds Read in Poppler CVE-2025-32365 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...
AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1783441581)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783441581 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...
Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1775817651)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775817651 advisory. - Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 3...
Rocky Linux 8 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2024_5305)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245305 advisory. poppler: pdfinfo: crash in broken documents when using -dests parameter CVE-2024-6239 Tenable has extracted the preceding description block directly from the CIQ...
AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2025:1761261363)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1761261363 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc...
AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1788270342)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788270342 advisory. - libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc...
EUVD-2026-89437
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and migh...
AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2025:1744631318)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744631318 advisory. - A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain...
CentOS Linux 7 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-demos / etc (CENTOS7:CLSA-2026:1786352279)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786352279 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...