Every CVE Search/ Get API key

CVE-2008-2950

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets...

7.5 HighPublic exploitFix available

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Exploit likelihood

15.0%Down 32.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Record
CVE-2008-2950
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Record
CVE-2008-2950
Updated
2026-11-02
EUVDEUVD-2008-2941 No score

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Record
EUVD-2008-2941
Updated
2026-11-03
GitHub AdvisoriesGHSA-wx8f-9362-6rfq No score

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets...

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Record
GHSA-wx8f-9362-6rfq
Weakness
CWE-94
Updated
2026-11-02
OSV No score

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Record
CVE-2008-2950
Updated
2026-11-02
OSVDEBIAN-CVE-2008-2950 No score

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.

Record
DEBIAN-CVE-2008-2950
Updated
2026-11-02
OSVopenSUSE-SU-2024:11181-1 No score

libpoppler-cpp0-21.08.0-1.3 on GA media

These are all security issues fixed in the libpoppler-cpp0-21.08.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11181-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
poppler
Debian:12
 before 0.8.4-1.1
0.8.4-1.1
poppler
Debian:13
 before 0.8.4-1.1
0.8.4-1.1
poppler
Debian:14
 before 0.8.4-1.1
0.8.4-1.1
poppler
Debian:5.0
 before 0.8.2-2+lenny1
0.8.2-2+lenny1
poppler
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 21.08.0-1.3
21.08.0-1.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPoppler 0.8.4 - libpoppler Uninitialized pointer Code Execution2008-07-08

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2950 is a high vulnerability (CVSS 7.5) in Poppler, published July 7, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.0%, the 96th percentile. Fixed in poppler 0.8.4-1.1.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open