{"id":"CVE-2019-9199","aliases":["ALPINE-CVE-2019-9199","DEBIAN-CVE-2019-9199","EUVD-2019-18575","GHSA-2pr3-qrhm-jm7j","MGASA-2020-0294","SUSE-SU-2024:2137-1","SUSE-SU-2024:3541-1","UBUNTU-CVE-2019-9199","openSUSE-SU-2024:14278-1"],"status":"published","title":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL...","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02552,"percentile":0.85161,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2019-02-26T00:00:00Z","modified":"2026-11-03T06:32:35Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"podofo","fixed_in":["0.9.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpodofo","fixed_in":["0.9.6+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpodofo","fixed_in":["0.9.6+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpodofo","fixed_in":["0.9.6+dfsg-5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6+dfsg-5"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.1.mga7"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150300.3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1.1ubuntu1","0.9.0-1.2","0.9.0-1.2ubuntu0.1~esm1","0.9.0-1.2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1.3","0.9.3-3","0.9.3-4","0.9.3-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpodofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5-6","0.9.5-8","0.9.5-8build1","0.9.5-9","0.9.5-9ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"podofo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"podofo_project","product":"podofo"}],"references":[{"url":"https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-setsource-podofo-0-9-6-trunk-r1967/","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://sourceforge.net/p/podofo/tickets/40/","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTJ5AAM6Y4NMSELEH7N5ZG4DNO56BCYF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIC2EXSSMBT3MY2HY42IIY4BUQS2SVYB/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://github.com/mksdev/podofo/commit/1400a9aaf611299b9a56aa2abeb158918b9743c8","tags":["x_transferred","fix"]},{"url":"https://github.com/jjanku/podofo/commit/ada821df68fb0bf673840ed525daf4ec709dbfd9","tags":["x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9199"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIC2EXSSMBT3MY2HY42IIY4BUQS2SVYB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTJ5AAM6Y4NMSELEH7N5ZG4DNO56BCYF/"},{"url":"https://github.com/advisories/GHSA-2pr3-qrhm-jm7j"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9199","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9199","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0294.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24385","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Y6ZKYPW55PN6XV5XW6KZDIJLWRXON74N/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5Z7UF3AC76HHLSAHVBUQWMYXHR33DR34/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4K6FST3UH3WNUNCIAEEGZJJASCP5ZXUF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SSB4HRLHF7H3DPNTFPTXUE6EGXXZ5JSZ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WR6XY3TOLJPLXOGHYPCB42JW3SWRZNY4/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242137-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1127514","tags":["report"]},{"url":"https://bugzilla.suse.com/1127855","tags":["report"]},{"url":"https://bugzilla.suse.com/1131544","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9199","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243541-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1023072","tags":["report"]},{"url":"https://bugzilla.suse.com/1023190","tags":["report"]},{"url":"https://bugzilla.suse.com/1027776","tags":["report"]},{"url":"https://bugzilla.suse.com/1027779","tags":["report"]},{"url":"https://bugzilla.suse.com/1027785","tags":["report"]},{"url":"https://bugzilla.suse.com/1027786","tags":["report"]},{"url":"https://bugzilla.suse.com/1027787","tags":["report"]},{"url":"https://bugzilla.suse.com/1037000","tags":["report"]},{"url":"https://bugzilla.suse.com/1075772","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5308","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-9199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9199","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20093","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9199","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T00:00:00Z","modified":"2024-08-04T21:38:46.611Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-18575","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T00:00:00Z","modified":"2024-08-04T21:38:46Z","updated_at":"2026-11-03T03:06:39.848951Z"}],"ghsa":[{"id":"GHSA-2pr3-qrhm-jm7j","title":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL...","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2022-05-14T01:13:35Z","modified":"2023-10-27T21:30:21Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:54:48.16134Z"}],"nvd":[{"id":"CVE-2019-9199","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T23:29:00.247Z","modified":"2026-06-17T02:43:20.357Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"ALPINE-CVE-2019-9199","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T23:29:00.247Z","modified":"2026-11-03T06:32:35.637767814Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2019-9199","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T23:29:00.247Z","modified":"2026-10-24T14:06:18.633596392Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9199","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T23:29:00.247Z","modified":"2026-09-21T07:03:25.593691356Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-9199","description":"PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-02-26T23:29:00Z","modified":"2026-04-22T12:23:54.960411Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"MGASA-2020-0294","title":"Updated podofo packages fix security vulnerability","description":"The updated packages fix security vulnerabilities:\n\nA stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey()\nfunction in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote \nattackers to cause a denial-of-service via a crafted pdf file. (CVE-2018-12983)\n\nAn issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document,\npPage-\u003eGetObject()-\u003eGetDictionary().AddKey(PdfName(\"MediaBox\"),var) can be\nproblematic due to the function GetObject() being called for the pPage NULL\npointer object. The value of pPage at this point is 0x0, which causes a NULL\npointer dereference. (CVE-2018-20751)\n\nPoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6\nhas a NULL pointer dereference that can (for example) be triggered by sending a\ncrafted PDF file to the podofoimpose binary. It allows an attacker to cause\nDenial of Service (Segmentation fault) or possibly have unspecified other impact.\n(CVE-2019-9199)\n\nPoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in\nbase/PdfString.cpp. (CVE-2019-9687)\n\nThe PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows\nremote attackers to cause a denial of service (NULL pointer dereference) via a\ncrafted file, because of ImageExtractor.cpp. (CVE-2019-20093)\n","status":"published","published":"2020-07-30T13:06:40Z","modified":"2026-04-16T04:44:36.973298002Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:14278-1","title":"libpodofo-devel-0.10.3-2.1 on GA media","description":"These are all security issues fixed in the libpodofo-devel-0.10.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-20T00:00:00Z","modified":"2025-05-07T18:10:11.812464Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2137-1","title":"Security update for podofo","description":"This update for podofo fixes the following issues:\n\n- CVE-2019-9199: Fixed a NULL pointer dereference in podofoimpose (bsc#1127855)\n- CVE-2018-20797: Fixed an excessive memory allocation in PoDoFo:podofo_calloc (bsc#1127514)\n- CVE-2019-10723: Fixed a memory leak in PdfPagesTreeCache (bsc#1131544)\n","status":"published","published":"2024-06-21T11:08:09Z","modified":"2026-02-04T02:57:05.276785Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:3541-1","title":"Security update for podofo","description":"This update for podofo fixes the following issues:\n\n - CVE-2015-8981: Fixed heap overflow in the function ReadXRefSubsection (bsc#1023190)\n - CVE-2017-6840: Fixed invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027787)\n - CVE-2017-6841: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h) (bsc#1027786)\n - CVE-2017-6842: Fixed NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp) (bsc#1027785)\n - CVE-2017-6845: Fixed NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h) (bsc#1027779)\n - CVE-2017-6849: Fixed NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp) (bsc#1027776)\n - CVE-2017-8378: Fixed denial of service (application crash) vectors related to m_offsets.size (PdfParser::ReadObjects func in base/PdfParser.cpp) (bsc#1037000)  \n - CVE-2018-5308: Fixed Undefined behavior  (memcpy with NULL pointer) in PdfMemoryOutputStream::Write (src/base/PdfOutputStream.cpp) (bsc#1075772)\n - CVE-2019-10723: Fixed Memory leak in PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp (bsc#1131544)\n - CVE-2019-9199: Fixed NULL pointer dereference in function PoDoFo:Impose:PdfTranslator:setSource() in pdftranslator.cpp (bsc#1127855)\n\n - Fixed NULL pointer dereference in PdfInfo::GuessFormat (pdfinfo.cpp) (bsc#1023072)\n","status":"published","published":"2024-10-08T08:33:37Z","modified":"2026-02-04T03:22:38.825984Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}