CVE-2019-13287
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath:...
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
- Record
CVE-2019-13287- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
- Record
CVE-2019-13287- Updated
- 2026-11-02
EUVDEUVD-2019-4793 No score
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
- Record
EUVD-2019-4793- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p9qv-hhrp-m74q
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath:...
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
- Record
GHSA-p9qv-hhrp-m74q- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13287
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
- Record
UBUNTU-CVE-2019-13287- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2023:4187-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2019-13287: Fixed an out-of-bounds read vulnerability in the function SplashXPath:strokeAdjust. (bsc#1140745)
- CVE-2018-18456: Fixed a stack-based buffer over-read via a crafted pdf file. (bsc#1112428)
- CVE-2018-18454: Fixed heap-based buffer over-read) via a crafted pdf file. (bsc#1112424)
- CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph. (bsc#1214256)
- Record
SUSE-SU-2023:4187-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4362-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2019-9545: Fixed a potential crash due to uncontrolled recursion in the JBIG parser (bsc#1128114).
- CVE-2019-9631: Fixed an out of bounds read when converting a PDF to an image (bsc#1129202).
- CVE-2022-37052: Fixed a reachable assertion when extracting pages of a PDf file (bsc#1214726).
- CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph (bsc#1214256).
- CVE-2019-13287: Fixed an out-of-bounds read vulnerability in the function SplashXPath:strokeAdjust (bsc#1140745).
- CVE-2018-18456: Fixed a stack-based buffer over-read via a crafted pdf file (bsc#1112428).
- CVE-2018-18454: Fixed heap-based buffer over-read via a crafted pdf file (bsc#1112424).
- CVE-2019-14292: Fixed an out of bounds read in GfxState.cc (bsc#1143570).
- CVE-2022-48545: Fixed an infinite recursion in Catalog::findDestInTree which can cause denial of service (bsc#1214723).
- Record
SUSE-SU-2023:4362-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
poppleropenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 0.62.0-150000.4.28.2 | 0.62.0-150000.4.28.2 |
popplerSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 9 CVEs |
before 0.43.0-16.40.1 | 0.43.0-16.40.1 |
poppler-qtSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 9 CVEs |
before 0.43.0-16.40.1 | 0.43.0-16.40.1 |
popplerSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 9 CVEs |
before 0.43.0-16.40.1 | 0.43.0-16.40.1 |
poppler-qtSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 9 CVEs |
before 0.43.0-16.40.1 | 0.43.0-16.40.1 |
popplerSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 9 CVEs |
before 0.43.0-16.40.1 | 0.43.0-16.40.1 |
poppler-qtSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 9 CVEs |
before 0.43.0-16.40.1 | 0.43.0-16.40.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13287 is a medium vulnerability (CVSS 5.5) in Glyphandcog Xpdfreader, published July 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. No source names a fixed version.
References
github.com/PanguL4b/pocs/tree/master/xpdf/out-of-bounds-read-in-SplashXPath__strokeAdjust
nvd.nist.gov/vuln/detail/CVE-2019-13287
suse.com/support/update/announcement/2023/suse-su-20234187-1
bugzilla.suse.com/1112424
Show 19 moreShow less
ubuntu.com/security/CVE-2019-13287
cve.org/CVERecord?id=CVE-2019-13287