{"id":"CVE-2018-21009","aliases":["DEBIAN-CVE-2018-21009","DLA-1939-1","DLA-2287-1","EUVD-2018-13533","GHSA-2x97-hfgj-7xpw","RHSA-2020:1074","SUSE-SU-2023:2838-1","SUSE-SU-2023:2906-1","SUSE-SU-2023:2907-1","UBUNTU-CVE-2018-21009","USN-4646-1"],"status":"published","title":"Poppler before 0.76.0 has an integer overflow in Parser::makeStream in Parser.cc.","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01894,"percentile":0.7978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2019-09-05T03:24:29Z","modified":"2026-10-23T18:03:05Z","fixes":[{"ecosystem":"Debian:12","package":"poppler","fixed_in":["0.69.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["0.69.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["0.69.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"poppler","fixed_in":["0.41.0-0ubuntu1.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"poppler","fixed_in":["0.62.0-2ubuntu2.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.69.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.69.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.69.0-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.5-2+deb8u11"}]}],"versions":["0.26.5-2","0.26.5-2+deb8u1","0.26.5-2+deb8u10","0.26.5-2+deb8u1~bpo70+1","0.26.5-2+deb8u2","0.26.5-2+deb8u3","0.26.5-2+deb8u4","0.26.5-2+deb8u5","0.26.5-2+deb8u6","0.26.5-2+deb8u7","0.26.5-2+deb8u8","0.26.5-2+deb8u9"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.48.0-2+deb9u3"}]}],"versions":["0.48.0-2","0.48.0-2+deb9u1","0.48.0-2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.4-14.26.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.15"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.11"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.15"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.11"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10"],"bundled":5}],"products":[{"vendor":"freedesktop","product":"poppler"}],"references":[{"url":"https://gitlab.freedesktop.org/poppler/poppler/commit/0868c499a9f5f37f8df5c9fef03c37496b40fc8a","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00033.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-21009","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2x97-hfgj-7xpw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-21009","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1074","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753850","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1074.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-21009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-21009","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9959","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9959","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10871","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11459","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12293","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232838-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136105","tags":["report"]},{"url":"https://bugzilla.suse.com/1149635","tags":["report"]},{"url":"https://bugzilla.suse.com/1199272","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27337","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232906-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092945","tags":["report"]},{"url":"https://bugzilla.suse.com/1102531","tags":["report"]},{"url":"https://bugzilla.suse.com/1107597","tags":["report"]},{"url":"https://bugzilla.suse.com/1114966","tags":["report"]},{"url":"https://bugzilla.suse.com/1115185","tags":["report"]},{"url":"https://bugzilla.suse.com/1115186","tags":["report"]},{"url":"https://bugzilla.suse.com/1115187","tags":["report"]},{"url":"https://bugzilla.suse.com/1115626","tags":["report"]},{"url":"https://bugzilla.suse.com/1120939","tags":["report"]},{"url":"https://bugzilla.suse.com/1124150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7310","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-21009","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4646-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-27778","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-21009","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2019-09-05T03:24:29Z","modified":"2024-08-05T12:19:27.146Z","updated_at":"2026-11-02T14:35:02.289647Z"}],"euvd":[{"id":"EUVD-2018-13533","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2019-09-05T03:24:29Z","modified":"2024-08-05T12:19:27Z","updated_at":"2026-11-03T02:39:28.765449Z"}],"ghsa":[{"id":"GHSA-2x97-hfgj-7xpw","title":"Poppler before 0.76.0 has an integer overflow in Parser::makeStream in Parser.cc.","description":"Poppler before 0.76.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2022-05-24T22:00:24Z","modified":"2023-01-30T05:04:33Z","updated_at":"2026-11-02T14:47:04.563666Z"}],"nvd":[{"id":"CVE-2018-21009","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2019-09-05T04:15:09.87Z","modified":"2026-06-17T01:53:56.87Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:04:59.278647Z"}],"osv":[{"id":"CVE-2018-21009","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2019-09-05T04:15:09.87Z","modified":"2026-10-20T13:37:41.995262091Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-21009","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2019-09-05T04:15:09.87Z","modified":"2026-10-23T18:03:05.663217728Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"RHSA-2020:1074","title":"Red Hat Security Advisory: poppler and evince security update","status":"published","published":"2024-09-16T02:49:45Z","modified":"2026-06-27T10:09:24Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-21009","description":"Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.","status":"published","published":"2019-09-05T04:15:00Z","modified":"2026-04-22T11:53:27.234963Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-1939-1","title":"poppler - security update","status":"published","published":"2019-09-30T00:00:00Z","modified":"2026-03-09T01:19:57.987992Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2287-1","title":"poppler - security update","status":"published","published":"2020-07-23T00:00:00Z","modified":"2026-03-09T01:18:27.964067Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"SUSE-SU-2023:2838-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).\n  - CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).\n  - CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105).\n","status":"published","published":"2023-07-14T19:26:51Z","modified":"2026-02-04T03:43:16.417749Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2906-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).\n  - CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).\n  - CVE-2018-20481: Fixed memory leak in GfxColorSpace:setDisplayProfile in GfxState.cc (bsc#1114966).\n  - CVE-2019-7310: Fixed a heap-based buffer over-read allows remote attackers to cause DOS via a special crafted PDF (bsc#1124150).\n  - CVE-2018-13988: Fixed buffer overflow in pdfunite (bsc#1102531).\n  - CVE-2018-16646: Fixed infinite recursion in poppler/Parser.cc:Parser::getObj() function (bsc#1107597).\n  - CVE-2018-19058: Fixed reachable abort in Object.h leading to denial of service (bsc#1115187).\n  - CVE-2018-19059: Fixed out-of-bounds read in EmbFile:save2 in FileSpec.cc leading to denial of service (bsc#1115186).\n  - CVE-2018-19060: Fixed NULL pointer dereference in goo/GooString.h leading to denial of service (bsc#1115185).\n  - CVE-2018-19149: Fixed NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment (bsc#1115626).\n  - CVE-2017-18267: Fixed denial of service (infinite recursion) via a crafted PDF file (bsc#1092945).\n  - CVE-2018-20650: Fixed issue where a reachable Object in dictLookup assertion allows attackers to cause DOS (bsc#1120939).\n\n\n","status":"published","published":"2023-07-20T08:19:44Z","modified":"2026-02-04T04:16:11.424712Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2907-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).\n  - CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).\n  - CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105).\n  - CVE-2018-20481: Fixed memory leak in GfxColorSpace:setDisplayProfile in GfxState.cc (bsc#1114966).\n  - CVE-2019-7310: Fixed a heap-based buffer over-read allows remote attackers to cause DOS via a special crafted PDF (bsc#1124150).\n  - CVE-2018-13988: Fixed buffer overflow in pdfunite (bsc#1102531).\n  - CVE-2018-16646: Fixed infinite recursion in poppler/Parser.cc:Parser::getObj() function (bsc#1107597).\n  - CVE-2018-19058: Fixed reachable abort in Object.h leading to denial of service (bsc#1115187).\n  - CVE-2018-19059: Fixed out-of-bounds read in EmbFile:save2 in FileSpec.cc leading to denial of service (bsc#1115186).\n  - CVE-2018-19060: Fixed NULL pointer dereference in goo/GooString.h leading to denial of service (bsc#1115185).\n  - CVE-2018-19149: Fixed NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment (bsc#1115626).\n  - CVE-2017-18267: Fixed denial of service (infinite recursion) via a crafted PDF file (bsc#1092945).\n  - CVE-2018-20650: Fixed issue where a reachable Object in dictLookup assertion allows attackers to cause DOS (bsc#1120939).\n\n","status":"published","published":"2023-07-20T08:20:53Z","modified":"2026-02-04T03:21:13.547323Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-4646-1","title":"poppler vulnerabilities","description":"It was discovered that Poppler incorrectly handled certain files. If a user\nor automated system were tricked into opening a crafted PDF file, an\nattacker could cause a denial of service.\n","status":"published","published":"2020-11-25T18:03:42Z","modified":"2026-04-22T10:09:08.294095Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}