CVE-2017-14519
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after...
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
CVE-2017-14519- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
CVE-2017-14519- Updated
- 2026-11-02
EUVDEUVD-2017-6020 No score
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
EUVD-2017-6020- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h552-2xrp-fmr5
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after...
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
GHSA-h552-2xrp-fmr5- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
CVE-2017-14519- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-14519
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
DEBIAN-CVE-2017-14519- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-14519
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- Record
UBUNTU-CVE-2017-14519- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0360 No score
Updated poppler packages fix security vulnerabilities
In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document. (CVE-2017-14517)
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop). (CVE-2017-14519)
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files. (CVE-2017-14520)
- Record
MGASA-2017-0360- Updated
- 2026-11-02
OSVUSN-3433-1 No score
poppler vulnerabilities
It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial service. This issue only affected Ubuntu 17.04. (CVE-2017-14517)
It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service. (CVE-2017-14519)
- Record
USN-3433-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
before 0.61.1-2 | 0.61.1-2 |
popplerDebian:13 |
before 0.61.1-2 | 0.61.1-2 |
popplerDebian:14 |
before 0.61.1-2 | 0.61.1-2 |
popplerDebian:7 |
before 0.18.4-6+deb7u3, plus listed versions 0.18.4-60.18.4-6+deb7u10.18.4-6+deb7u2 |
0.18.4-6+deb7u3 |
popplerDebian:8 |
before 0.26.5-2+deb8u2, plus listed versions 0.26.5-20.26.5-2+deb8u10.26.5-2+deb8u1~bpo70+1 |
0.26.5-2+deb8u2 |
popplerDebian:9 |
before 0.48.0-2+deb9u1, plus listed versions 0.48.0-2 |
0.48.0-2+deb9u1 |
popplerMageia:5 |
before 0.26.5-2.4.mga5 | 0.26.5-2.4.mga5 |
popplerMageia:6 |
before 0.52.0-3.2.mga6 | 0.52.0-3.2.mga6 |
popplerUbuntu:14.04:LTS |
before 0.24.5-2ubuntu4.6, plus listed versions 0.24.1-0ubuntu10.24.3-0ubuntu10.24.3-0ubuntu20.24.3-0ubuntu30.24.3-0ubuntu4 Show 15 moreShow less0.24.3-0ubuntu50.24.3-0ubuntu60.24.3-0ubuntu70.24.3-0ubuntu80.24.3-0ubuntu100.24.3-0ubuntu120.24.5-0ubuntu30.24.5-2ubuntu10.24.5-2ubuntu20.24.5-2ubuntu40.24.5-2ubuntu4.10.24.5-2ubuntu4.20.24.5-2ubuntu4.30.24.5-2ubuntu4.40.24.5-2ubuntu4.5 |
0.24.5-2ubuntu4.6 |
popplerUbuntu:16.04:LTS |
before 0.41.0-0ubuntu1.3, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.10.41.0-0ubuntu1.2 |
0.41.0-0ubuntu1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14519 is a high vulnerability (CVSS 7.5) in Freedesktop Poppler, published September 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in poppler 0.61.1-2.