{"id":"CVE-2019-17064","aliases":["EUVD-2019-7536","GHSA-f8rj-5pq9-gmfw","MGASA-2019-0422","UBUNTU-CVE-2019-17064"],"status":"published","title":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized...","description":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01413,"percentile":0.72884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2019-10-01T15:22:44Z","modified":"2026-10-17T12:55:06Z","fixes":[{"ecosystem":"Mageia:7","package":"xpdf","fixed_in":["4.02-1.1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.02-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.4-2.1","7.1.8-1","7.1.10-1","7.1.10-1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.7-2","7.2.7-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.9-1","7.2.13-2","7.2.13-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.23+dfsg1-2","7.2.24+dfsg1-1","7.2.24+dfsg1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.27+dfsg1-2","7.2.28-2","7.2.28-2.1build2","7.2.28-2.1build3","7.2.28-2.1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.30-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.30-1build2","7.2.30-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.30-1build1","7.2.30-1build2"]}],"products":[{"vendor":"glyphandcog","product":"xpdfreader"}],"references":[{"url":"https://forum.xpdfreader.com/viewtopic.php?f=3\u0026t=41890","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Vendor Advisory","report"]},{"url":"http://packetstormsecurity.com/files/154713/Xpdf-4.02-NULL-Pointer-Dereference.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5PYIAP2RXTYD4Y4FYFIK5K644LMDJWX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMDB2CGUYDW2RENE2I2TT6QNFEEI2CNF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17064"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D5PYIAP2RXTYD4Y4FYFIK5K644LMDJWX/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMDB2CGUYDW2RENE2I2TT6QNFEEI2CNF/"},{"url":"https://github.com/advisories/GHSA-f8rj-5pq9-gmfw"},{"url":"https://advisories.mageia.org/MGASA-2019-0422.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25973","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TMDB2CGUYDW2RENE2I2TT6QNFEEI2CNF/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17064","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-17064","description":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.","status":"published","published":"2019-10-01T15:22:44Z","modified":"2024-08-05T01:33:17.015Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7536","description":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.","status":"published","published":"2019-10-01T15:22:44Z","modified":"2024-08-05T01:33:17Z","updated_at":"2026-11-03T02:40:30.885546Z"}],"ghsa":[{"id":"GHSA-f8rj-5pq9-gmfw","title":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized...","description":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.","status":"published","published":"2022-05-24T16:57:31Z","modified":"2023-01-28T05:07:43Z","updated_at":"2026-11-02T14:44:34.06652Z"}],"nvd":[{"id":"CVE-2019-17064","description":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.","status":"published","published":"2019-10-01T16:15:11.593Z","modified":"2026-06-17T02:23:15.063Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"UBUNTU-CVE-2019-17064","description":"Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.","status":"published","published":"2019-10-01T16:15:00Z","modified":"2026-10-17T12:55:06.602217837Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2019-0422","title":"Updated xpdf packages fix security vulnerability","description":"The updated packages fix a security vulnerability:\n\nCatalog.cc in Xpdf 4.02 has a NULL pointer dereference because\nCatalog.pageLabels is initialized too late in the Catalog\nconstructor. (CVE-2019-17064)\n","status":"published","published":"2019-12-31T16:51:17Z","modified":"2026-04-16T04:43:05.123327686Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}