CVE-2019-12360
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf...
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
CVE-2019-12360- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
CVE-2019-12360- Updated
- 2026-11-02
EUVDEUVD-2019-3995 No score
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
EUVD-2019-3995- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h895-jpgg-q54p No score
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf...
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
GHSA-h895-jpgg-q54p- Updated
- 2026-11-02
OSV
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
CVE-2019-12360- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12360
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
DEBIAN-CVE-2019-12360- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12360
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
- Record
UBUNTU-CVE-2019-12360- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0291 No score
Updated xpdf packages fix security vulnerability
A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content. (CVE-2019-12360)
- Record
MGASA-2020-0291- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
before 0.38.0-2 | 0.38.0-2 |
popplerDebian:13 |
before 0.38.0-2 | 0.38.0-2 |
popplerDebian:14 |
before 0.38.0-2 | 0.38.0-2 |
popplerDebian:8 From an advisory covering 3 CVEs |
before 0.26.5-2+deb8u10, plus listed versions 0.26.5-20.26.5-2+deb8u10.26.5-2+deb8u1~bpo70+10.26.5-2+deb8u20.26.5-2+deb8u3 Show 6 moreShow less0.26.5-2+deb8u40.26.5-2+deb8u50.26.5-2+deb8u60.26.5-2+deb8u70.26.5-2+deb8u80.26.5-2+deb8u9 |
0.26.5-2+deb8u10 |
xpdfMageia:7 |
before 4.02-1.2.mga7 | 4.02-1.2.mga7 |
texlive-binUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2015.20150524.37493-5build12015.20150524.37493-72015.20150524.37493-7build12015.20150524.37493-7build42015.20160222.37495-12015.20160222.37495-1ubuntu0.12015.20160222.37495-1ubuntu0.1+esm1 |
None known |
emscriptenUbuntu:16.04:LTS |
All versions, plus listed versions 1.22.1-1build1 |
None known |
texlive-binUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2017.20170613.44572-5build12017.20170613.44572-5build22017.20170613.44572-62017.20170613.44572-6build12017.20170613.44572-6ubuntu1 Show 4 moreShow less2017.20170613.44572-8build12017.20170613.44572-8ubuntu0.12017.20170613.44572-8ubuntu0.22017.20170613.44572-8ubuntu0.2+esm1 |
None known |
emscriptenUbuntu:18.04:LTS |
All versions, plus listed versions 1.22.1-1build1 |
None known |
texlive-binUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2019.20190605.51237-2build12019.20190605.51237-32019.20190605.51237-3build12019.20190605.51237-3build22019.20190605.51237-3ubuntu0.12019.20190605.51237-3ubuntu0.22019.20190605.51237-3ubuntu0.2+esm1 |
None known |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
emscriptenUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.13~dfsg-13.1.1~dfsg+~1.39.6-5ubuntu43.1.2~dfsg+~1.39.6-6ubuntu13.1.3~dfsg-4ubuntu13.1.3~dfsg-5ubuntu13.1.4~dfsg-7ubuntu13.1.5~dfsg-3ubuntu1 |
None known |
texlive-binUbuntu:22.04:LTS |
All versions, plus listed versions 2020.20200327.54578-72020.20200327.54578-7build12021.20210626.59705-12021.20210626.59705-1build12021.20210626.59705-1ubuntu0.12021.20210626.59705-1ubuntu0.22021.20210626.59705-1ubuntu0.3 |
None known |
emscriptenUbuntu:24.04:LTS |
All versions, plus listed versions 3.1.6~dfsg-53.1.6~dfsg-63.1.6~dfsg-7 |
None known |
texlive-binUbuntu:24.04:LTS |
All versions, plus listed versions 2023.20230311.66589-62023.20230311.66589-72023.20230311.66589-82023.20230311.66589-8build12023.20230311.66589-92023.20230311.66589-9build22023.20230311.66589-9build3 |
None known |
emscriptenUbuntu:25.10 |
All versions, plus listed versions 3.1.69+dfsg-13.1.69+dfsg-3 |
None known |
texlive-binUbuntu:25.10 |
All versions, plus listed versions 2024.20240313.70630+ds-62024.20240313.70630+ds-6ubuntu2 |
None known |
emscriptenUbuntu:26.10 |
All versions, plus listed versions 3.1.69+dfsg-46.0.5+dfsg+~1.41.5-2 |
None known |
texlive-binUbuntu:26.10 |
All versions, plus listed versions 2025.20250727.75242+ds-5build12026.20260303.78225+ds-42026.20260303.78225+ds-5ubuntu1 |
None known |
emscriptenUbuntu:26.04:LTS |
All versions, plus listed versions 3.1.69+dfsg-33.1.69+dfsg-4 |
None known |
texlive-binUbuntu:26.04:LTS |
All versions, plus listed versions 2024.20240313.70630+ds-6ubuntu22025.20250727.75242+ds-4ubuntu22025.20250727.75242+ds-52025.20250727.75242+ds-5build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12360 is a high vulnerability (CVSS 7.1) in Glyphandcog Xpdfreader, published May 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in poppler 0.38.0-2.
References
forum.xpdfreader.com/viewtopic.php?f=3&t=41801
lists.debian.org/debian-lts-announce/2019/06/msg00002.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQBAHQQF2P7E6PL5STST3TGH7VPVXKKQ
nvd.nist.gov/vuln/detail/CVE-2019-12360
Show 8 moreShow less
github.com/advisories/GHSA-h895-jpgg-q54p
security-tracker.debian.org/tracker/CVE-2019-12360
advisories.mageia.org/MGASA-2020-0291.html
bugs.mageia.org/show_bug.cgi?id=26920
ubuntu.com/security/CVE-2019-12360
cve.org/CVERecord?id=CVE-2019-12360