{"id":"CVE-2019-12293","aliases":["BELL-CVE-2019-12293","DEBIAN-CVE-2019-12293","DLA-1815-1","DLA-2287-1","EUVD-2019-3933","GHSA-vw78-hqhc-j4hj","MGASA-2019-0244","MGASA-2019-0245","OESA-2021-1378","RHSA-2019:2713","RHSA-2020:1074","SUSE-SU-2023:2838-1","SUSE-SU-2023:2907-1","UBUNTU-CVE-2019-12293","USN-4042-1"],"status":"published","title":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in...","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02094,"percentile":0.81769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-05-23T00:00:00Z","modified":"2026-10-20T10:50:39Z","fixes":[{"ecosystem":"Debian:12","package":"poppler","fixed_in":["0.71.0-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["0.71.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["0.71.0-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"poppler","fixed_in":["0.41.0-0ubuntu1.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"poppler","fixed_in":["0.62.0-2ubuntu2.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-5"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.5-2+deb8u10"}]}],"versions":["0.26.5-2","0.26.5-2+deb8u1","0.26.5-2+deb8u1~bpo70+1","0.26.5-2+deb8u2","0.26.5-2+deb8u3","0.26.5-2+deb8u4","0.26.5-2+deb8u5","0.26.5-2+deb8u6","0.26.5-2+deb8u7","0.26.5-2+deb8u8","0.26.5-2+deb8u9"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.48.0-2+deb9u3"}]}],"versions":["0.48.0-2","0.48.0-2+deb9u1","0.48.0-2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.52.0-3.13.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-3.1.mga7"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67.0-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67.0-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-cpp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-qt5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.66.0-11.el8_0.12"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-9.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"poppler-qt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.5-42.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.25.1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.14"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.9"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.14"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.9"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8"],"bundled":12}],"products":[{"vendor":"freedesktop","product":"poppler"}],"references":[{"url":"https://gitlab.freedesktop.org/poppler/poppler/issues/768","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence"]},{"url":"http://www.securityfocus.com/bid/108457","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWS7NVFFCUY3YSTMEKZEJEU6JVUUBKHB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4042-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2713","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12293","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YWS7NVFFCUY3YSTMEKZEJEU6JVUUBKHB/"},{"url":"https://github.com/advisories/GHSA-vw78-hqhc-j4hj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-12293","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12293","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0244.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25233","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2022","tags":["web"]},{"url":"https://usn.ubuntu.com/4091-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0245.html","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27778","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672419","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732340","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2713.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-18897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18897","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20481","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20551","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20650","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20662","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7310","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7310","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7310","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9200","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9631","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9903","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9959","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9959","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10871","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12293","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1074","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753850","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1074.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-21009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-21009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-21009","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11459","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232838-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136105","tags":["report"]},{"url":"https://bugzilla.suse.com/1149635","tags":["report"]},{"url":"https://bugzilla.suse.com/1199272","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27337","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092945","tags":["report"]},{"url":"https://bugzilla.suse.com/1102531","tags":["report"]},{"url":"https://bugzilla.suse.com/1107597","tags":["report"]},{"url":"https://bugzilla.suse.com/1114966","tags":["report"]},{"url":"https://bugzilla.suse.com/1115185","tags":["report"]},{"url":"https://bugzilla.suse.com/1115186","tags":["report"]},{"url":"https://bugzilla.suse.com/1115187","tags":["report"]},{"url":"https://bugzilla.suse.com/1115626","tags":["report"]},{"url":"https://bugzilla.suse.com/1120939","tags":["report"]},{"url":"https://bugzilla.suse.com/1124150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7310","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-12293","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4042-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10873","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-12293","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2019-05-23T04:54:12Z","modified":"2024-08-04T23:17:39.558Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-3933","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2019-05-23T04:54:12Z","modified":"2024-08-04T23:17:39Z","updated_at":"2026-11-03T02:40:46.416719Z"}],"ghsa":[{"id":"GHSA-vw78-hqhc-j4hj","title":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in...","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2022-05-24T21:59:59Z","modified":"2023-01-30T05:04:17Z","updated_at":"2026-11-02T14:47:00.827412Z"}],"nvd":[{"id":"CVE-2019-12293","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2019-05-23T05:29:00.183Z","modified":"2026-06-17T02:14:22.777Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:14.729983Z"}],"osv":[{"id":"BELL-CVE-2019-12293","title":"CVE-2019-12293 does not affect BellSoft software","status":"withdrawn","published":"2019-05-23T05:29:00Z","modified":"2026-01-26T09:46:49.824081Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-12293","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2019-05-23T05:29:00.183Z","modified":"2026-10-20T10:50:39.566431477Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12293","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2019-05-23T05:29:00.183Z","modified":"2026-09-21T07:01:46.693979485Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"OESA-2021-1378","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the \u0026apos;pdftohtml\u0026apos; program, would crash the application causing a denial of service.(CVE-2020-27778)\r\n\r\nIn Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.(CVE-2019-12293)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:04.838279923Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2019:2713","title":"Red Hat Security Advisory: poppler security update","status":"published","published":"2024-09-16T02:32:30Z","modified":"2026-06-27T10:08:05Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2020:1074","title":"Red Hat Security Advisory: poppler and evince security update","status":"published","published":"2024-09-16T02:49:45Z","modified":"2026-06-27T10:09:24Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-12293","description":"In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.","status":"published","published":"2019-05-23T00:00:00Z","modified":"2026-04-22T12:08:51.777215Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1815-1","title":"poppler - security update","status":"published","published":"2019-06-06T00:00:00Z","modified":"2026-03-09T01:21:39.835274Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2287-1","title":"poppler - security update","status":"published","published":"2020-07-23T00:00:00Z","modified":"2026-03-09T01:18:27.964067Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0244","title":"Updated poppler packages fix security vulnerabilities","description":"Updated poppler packages fix security vulnerabilities\n\nPoppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc\ndownsample_row_box_filter function. (CVE-2019-9631)\n\nPDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking,\nleading to stack consumption in the function Dict::find() located at\nDict.cc, which can (for example) be triggered by passing a crafted pdf\nfile to the pdfunite binary. (CVE-2019-9903)\n\nAn issue was discovered in Xpdf 4.01.01. There is an FPE in the function\nPostScriptFunction::exec at Function.cc for the psOpIdiv case.\n(CVE-2019-10018)\n\nAn issue was discovered in Xpdf 4.01.01. There is an FPE in the function\nImageStream::ImageStream at Stream.cc for nComps. (CVE-2019-10021)\n\nAn issue was discovered in Xpdf 4.01.01. There is an FPE in the function\nPostScriptFunction::exec at Function.cc for the psOpMod case.\n(CVE-2019-10023)\n\nAn issue was discovered in Poppler 0.74.0. There is a heap-based buffer\nover-read in the function Splash::blitTransparent at splash/Splash.cc.\n(CVE-2019-10872)\n\nIn Poppler through 0.76.1, there is a heap-based buffer over-read in\nJPXStream::init in JPEG2000Stream.cc via data with inconsistent heights\nor widths. (CVE-2019-12293)\n\nAn issue was discovered in Poppler through 0.78.0. There is a \ndivide-by-zero error in the function SplashOutputDev::tilingPatternFill\nat SplashOutputDev.cc. (CVE-2019-14494)\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:42:10.902850172Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0245","title":"Updated poppler packages fix security vulnerabilities","description":"Updated poppler packages fix security vulnerabilities\n\nPoppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc\ndownsample_row_box_filter function. (CVE-2019-9631)\n\nPDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking,\nleading to stack consumption in the function Dict::find() located at\nDict.cc, which can (for example) be triggered by passing a crafted pdf\nfile to the pdfunite binary. (CVE-2019-9903)\n\nAn issue was discovered in Poppler 0.74.0. There is a heap-based buffer\nover-read in the function Splash::blitTransparent at splash/Splash.cc.\n(CVE-2019-10872)\n\nAn issue was discovered in Poppler 0.74.0. There is a NULL pointer\ndereference in the function SplashClip::clipAALine at splash/SplashClip.cc.\n(CVE-2019-10873)\n\nIn Poppler through 0.76.1, there is a heap-based buffer over-read in\nJPXStream::init in JPEG2000Stream.cc via data with inconsistent heights\nor widths. (CVE-2019-12293)\n\nAn issue was discovered in Poppler through 0.78.0. There is a \ndivide-by-zero error in the function SplashOutputDev::tilingPatternFill\nat SplashOutputDev.cc. (CVE-2019-14494)\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:41:41.789494204Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2023:2838-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).\n  - CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).\n  - CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105).\n","status":"published","published":"2023-07-14T19:26:51Z","modified":"2026-02-04T03:43:16.417749Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2907-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).\n  - CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).\n  - CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105).\n  - CVE-2018-20481: Fixed memory leak in GfxColorSpace:setDisplayProfile in GfxState.cc (bsc#1114966).\n  - CVE-2019-7310: Fixed a heap-based buffer over-read allows remote attackers to cause DOS via a special crafted PDF (bsc#1124150).\n  - CVE-2018-13988: Fixed buffer overflow in pdfunite (bsc#1102531).\n  - CVE-2018-16646: Fixed infinite recursion in poppler/Parser.cc:Parser::getObj() function (bsc#1107597).\n  - CVE-2018-19058: Fixed reachable abort in Object.h leading to denial of service (bsc#1115187).\n  - CVE-2018-19059: Fixed out-of-bounds read in EmbFile:save2 in FileSpec.cc leading to denial of service (bsc#1115186).\n  - CVE-2018-19060: Fixed NULL pointer dereference in goo/GooString.h leading to denial of service (bsc#1115185).\n  - CVE-2018-19149: Fixed NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment (bsc#1115626).\n  - CVE-2017-18267: Fixed denial of service (infinite recursion) via a crafted PDF file (bsc#1092945).\n  - CVE-2018-20650: Fixed issue where a reachable Object in dictLookup assertion allows attackers to cause DOS (bsc#1120939).\n\n","status":"published","published":"2023-07-20T08:20:53Z","modified":"2026-02-04T03:21:13.547323Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-4042-1","title":"poppler vulnerabilities","description":"It was discovered that poppler incorrectly handled certain files. If a user\nor automated system were tricked into opening a crafted PDF file, an\nattacker could cause a denial of service, or possibly execute arbitrary\ncode\n","status":"published","published":"2019-06-27T13:29:23Z","modified":"2026-04-22T09:57:42.532685Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}