{"id":"CVE-2019-9588","aliases":["EUVD-2019-18959","GHSA-x665-4558-c73x","UBUNTU-CVE-2019-9588"],"status":"published","title":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can...","description":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01188,"percentile":0.68107,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2019-03-06T08:00:00Z","modified":"2026-10-17T12:55:50Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.20150524.37493-5build1","2015.20150524.37493-7","2015.20150524.37493-7build1","2015.20150524.37493-7build4","2015.20160222.37495-1","2015.20160222.37495-1ubuntu0.1","2015.20160222.37495-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2017.20170613.44572-5build1","2017.20170613.44572-5build2","2017.20170613.44572-6","2017.20170613.44572-6build1","2017.20170613.44572-6ubuntu1","2017.20170613.44572-8build1","2017.20170613.44572-8ubuntu0.1","2017.20170613.44572-8ubuntu0.2","2017.20170613.44572-8ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2019.20190605.51237-2build1","2019.20190605.51237-3","2019.20190605.51237-3build1","2019.20190605.51237-3build2","2019.20190605.51237-3ubuntu0.1","2019.20190605.51237-3ubuntu0.2","2019.20190605.51237-3ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2020.20200327.54578-7","2020.20200327.54578-7build1","2021.20210626.59705-1","2021.20210626.59705-1build1","2021.20210626.59705-1ubuntu0.1","2021.20210626.59705-1ubuntu0.2","2021.20210626.59705-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.20230311.66589-6","2023.20230311.66589-7","2023.20230311.66589-8","2023.20230311.66589-8build1","2023.20230311.66589-9","2023.20230311.66589-9build2","2023.20230311.66589-9build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6","2024.20240313.70630+ds-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.20250727.75242+ds-5build1","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6ubuntu2","2025.20250727.75242+ds-4ubuntu2","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5build1"]}],"products":[{"vendor":"glyphandcog","product":"xpdfreader"}],"references":[{"url":"https://research.loginsoft.com/bugs/invalid-memory-access-in-gatomiccounter-gatomicincrement-xpdf-4-01/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://forum.xpdfreader.com/viewtopic.php?f=3\u0026t=41261","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9588"},{"url":"https://github.com/advisories/GHSA-x665-4558-c73x"},{"url":"https://ubuntu.com/security/CVE-2019-9588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9588","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-9588","description":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-03-06T08:00:00Z","modified":"2024-08-04T21:54:44.602Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-18959","description":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-03-06T08:00:00Z","modified":"2024-08-04T21:54:44Z","updated_at":"2026-11-03T03:06:38.242317Z"}],"ghsa":[{"id":"GHSA-x665-4558-c73x","title":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can...","description":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2022-05-14T01:28:27Z","modified":"2023-02-02T05:03:52Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:44.264716Z"}],"nvd":[{"id":"CVE-2019-9588","description":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-03-06T08:29:00.37Z","modified":"2026-06-17T02:43:59.96Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:05:07.268578Z"}],"osv":[{"id":"UBUNTU-CVE-2019-9588","description":"There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.","status":"published","published":"2019-03-06T08:29:00Z","modified":"2026-10-17T12:55:50.762272098Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"}]}}