{"id":"CVE-2020-27778","aliases":["ALPINE-CVE-2020-27778","ALSA-2021:1881","BELL-CVE-2020-27778","DEBIAN-CVE-2020-27778","DLA-3120-1","EUVD-2020-20282","GHSA-9f25-w4h3-5q5x","MGASA-2020-0445","OESA-2021-1378","RHSA-2021:1881","RLSA-2021:1881","SUSE-SU-2021:3854-1","SUSE-SU-2022:1723-1","SUSE-SU-2022:1724-1","UBUNTU-CVE-2020-27778","USN-4646-1","openSUSE-SU-2021:3854-1"],"status":"published","title":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote...","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01976,"percentile":0.80668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-824"],"published":"2020-11-25T00:00:00Z","modified":"2026-10-29T11:01:20Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"poppler","fixed_in":["0.76.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"evince-devel","fixed_in":["3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"poppler-cpp","fixed_in":["20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"poppler-cpp-devel","fixed_in":["20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"poppler-devel","fixed_in":["20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"poppler-glib-devel","fixed_in":["20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"poppler-qt5","fixed_in":["20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"poppler-qt5-devel","fixed_in":["20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"poppler","fixed_in":["0.85.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["0.85.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["0.85.0-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"poppler","fixed_in":["0.74.0-3.4.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-cpp-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-debugsource","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-glib","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-glib-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-qt5-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-utils","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-utils-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debugsource","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-devel","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp-devel","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-debugsource","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-devel","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-glib-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-glib-devel","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5-devel","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-utils-debuginfo","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"evince","fixed_in":["0:3.28.4-11.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"poppler","fixed_in":["0:20.11.0-2.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"poppler","fixed_in":["0.41.0-0ubuntu1.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"poppler","fixed_in":["0.62.0-2ubuntu2.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.85.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.85.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.85.0-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-5+deb10u1"}]}],"versions":["0.71.0-5"],"bundled":9},{"source":"osv","ecosystem":"Mageia:7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-3.4.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67.0-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.67.0-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-cpp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-qt5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"poppler-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-glib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"poppler-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.11.0-2.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.19.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.19.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.19.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.19.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.19.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.19.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.4-14.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.15"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.11"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.15"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.11"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.6.1"}]}],"bundled":21}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"freedesktop","product":"poppler"},{"vendor":"poppler","product":"poppler"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1900712","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27778","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9f25-w4h3-5q5x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-27778","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-27778","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-27778","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-27778","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0445.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27687","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4646-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12293","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1881","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919423","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1881.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27778","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1881","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213854-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092945","tags":["report"]},{"url":"https://bugzilla.suse.com/1102531","tags":["report"]},{"url":"https://bugzilla.suse.com/1107597","tags":["report"]},{"url":"https://bugzilla.suse.com/1114966","tags":["report"]},{"url":"https://bugzilla.suse.com/1115185","tags":["report"]},{"url":"https://bugzilla.suse.com/1115186","tags":["report"]},{"url":"https://bugzilla.suse.com/1115187","tags":["report"]},{"url":"https://bugzilla.suse.com/1115626","tags":["report"]},{"url":"https://bugzilla.suse.com/1120495","tags":["report"]},{"url":"https://bugzilla.suse.com/1120496","tags":["report"]},{"url":"https://bugzilla.suse.com/1120939","tags":["report"]},{"url":"https://bugzilla.suse.com/1120956","tags":["report"]},{"url":"https://bugzilla.suse.com/1124150","tags":["report"]},{"url":"https://bugzilla.suse.com/1127329","tags":["report"]},{"url":"https://bugzilla.suse.com/1129202","tags":["report"]},{"url":"https://bugzilla.suse.com/1130229","tags":["report"]},{"url":"https://bugzilla.suse.com/1131696","tags":["report"]},{"url":"https://bugzilla.suse.com/1131722","tags":["report"]},{"url":"https://bugzilla.suse.com/1142465","tags":["report"]},{"url":"https://bugzilla.suse.com/1143950","tags":["report"]},{"url":"https://bugzilla.suse.com/1179163","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27778","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221724-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-27778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-21009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13283","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TS7QPSEQIBQO7BALZOE3TN7IO7IMHK3Y/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-27778","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-12-03T16:46:47Z","modified":"2024-08-04T16:25:42.413Z","cwes":["CWE-824"],"updated_at":"2026-11-02T14:35:53.552996Z"}],"euvd":[{"id":"EUVD-2020-20282","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-12-03T16:46:47Z","modified":"2024-08-04T16:25:42Z","updated_at":"2026-11-03T03:07:11.950168Z"}],"ghsa":[{"id":"GHSA-9f25-w4h3-5q5x","title":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote...","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2022-05-24T17:35:12Z","modified":"2023-02-03T05:06:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-824"],"updated_at":"2026-11-02T14:53:51.728884Z"}],"nvd":[{"id":"CVE-2020-27778","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-12-03T17:15:13.097Z","modified":"2026-06-17T03:09:37.583Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-824"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"ALPINE-CVE-2020-27778","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-12-03T17:15:13.097Z","modified":"2026-10-26T11:17:55.162759676Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-27778","title":"CVE-2020-27778 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:12.867358Z","modified":"2026-01-26T09:47:31.724466Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-27778","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-12-03T17:15:13.097Z","modified":"2026-10-24T10:30:31.146763101Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-27778","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-12-03T17:15:13.097Z","modified":"2026-10-26T12:02:42.362249225Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"OESA-2021-1378","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the \u0026apos;pdftohtml\u0026apos; program, would crash the application causing a denial of service.(CVE-2020-27778)\r\n\r\nIn Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.(CVE-2019-12293)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:04.838279923Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:1881","title":"Red Hat Security Advisory: poppler and evince security, bug fix, and enhancement update","status":"published","published":"2024-09-16T05:12:32Z","modified":"2026-06-27T10:13:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1881","title":"Moderate: poppler and evince security, bug fix, and enhancement update","description":"Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.\n\nThe evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.\n\nThe following packages have been upgraded to a later upstream version: poppler (20.11.0). (BZ#1644423)\n\nSecurity Fix(es):\n\n* poppler: pdftohtml: access to uninitialized pointer could lead to DoS (CVE-2020-27778)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:18:48Z","modified":"2026-02-05T14:45:03.83044Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-27778","description":"A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.","status":"published","published":"2020-11-25T00:00:00Z","modified":"2026-04-22T12:37:39.530602Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"ALSA-2021:1881","title":"Moderate: poppler and evince security, bug fix, and enhancement update","description":"Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.\n\nThe evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.\n\nThe following packages have been upgraded to a later upstream version: poppler (20.11.0). (BZ#1644423)\n\nSecurity Fix(es):\n\n* poppler: pdftohtml: access to uninitialized pointer could lead to DoS (CVE-2020-27778)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:18:48Z","modified":"2026-10-29T11:01:20.975124417Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3120-1","title":"poppler - security update","status":"published","published":"2022-09-26T00:00:00Z","modified":"2026-03-09T01:21:12.352272Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2020-0445","title":"Updated poppler packages fix a security vulnerability","description":"buffer overflow in pdftohtml could result in a DoS (CVE-2020-27778).\n","status":"published","published":"2020-12-03T09:54:38Z","modified":"2026-04-16T04:44:03.155693422Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:3854-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2017-18267: Fixed an infinite recursion that would allow remote attackers to cause a denial of service (bsc#1092945).\n- CVE-2018-13988: Added an improper implementation check which otherwise could allow buffer overflows, memory corruption, and denial of service (bsc#1102531).\n- CVE-2018-16646: Fixed an infinite recursion which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1107597).\n- CVE-2018-18897: Fixed a memory leak (bsc#1114966).\n- CVE-2018-19058: Fixed a bug which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1115187).\n- CVE-2018-19059: Fixed an out-of-bounds read access which could allow a denial-of-service attack (bsc#1115186).\n- CVE-2018-19060: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115185).\n- CVE-2018-19149: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115626).\n- CVE-2018-20481: Fixed a NULL pointer dereference while handling unallocated XRef entries which could allow a denial-of-service attack (bsc#1120495).\n- CVE-2018-20551: Fixed a reachable assertion which could allow a denial-of-service attack through specially crafted PDF files (bsc#1120496).\n- CVE-2018-20650: Fixed a reachable assertion which could allow denial-of-service through specially crafted PDF files (bsc#1120939).\n- CVE-2018-20662: Fixed a bug which could potentially crash the running process by SIGABRT resulting in a denial-of-service attack through a specially crafted PDF file (bsc#1120956).\n- CVE-2019-10871: Fixed a heap-based buffer  over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc (bsc#1131696).\n- CVE-2019-10872: Fixed a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc (bsc#1131722).\n- CVE-2019-14494: Fixed a divide-by-zero error in the function SplashOutputDev::tilingPatternFill (bsc#1143950).\n- CVE-2019-7310: Fixed a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) that allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document (bsc#1124150).\n- CVE-2019-9200: Fixed a heap-based buffer underwrite which could allow denial-of-service attack through a specially crafted PDF file (bsc#1127329)\n- CVE-2019-9631: Fixed a heap-based buffer over-read  in the CairoRescaleBox.cc downsample_row_box_filter function (bsc#1129202).\n- CVE-2019-9903: Fixed excessive stack consumption in the Dict::find() method, which can be triggered by passing a crafted pdf file to the pdfunite binary (bsc#1130229).\n- CVE-2019-9959: Fixed integer overflow that made it possible to allocate a large memory chunk on the heap with a size controlled by an attacker (bsc#1142465).\n- CVE-2020-27778: Fixed buffer overflow vulnerability in pdftohtml (bsc#1179163).\n  ","status":"published","published":"2021-12-01T15:59:12Z","modified":"2026-02-04T03:53:08.14644Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:3854-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2017-18267: Fixed an infinite recursion that would allow remote attackers to cause a denial of service (bsc#1092945).\n- CVE-2018-13988: Added an improper implementation check which otherwise could allow buffer overflows, memory corruption, and denial of service (bsc#1102531).\n- CVE-2018-16646: Fixed an infinite recursion which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1107597).\n- CVE-2018-18897: Fixed a memory leak (bsc#1114966).\n- CVE-2018-19058: Fixed a bug which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1115187).\n- CVE-2018-19059: Fixed an out-of-bounds read access which could allow a denial-of-service attack (bsc#1115186).\n- CVE-2018-19060: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115185).\n- CVE-2018-19149: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115626).\n- CVE-2018-20481: Fixed a NULL pointer dereference while handling unallocated XRef entries which could allow a denial-of-service attack (bsc#1120495).\n- CVE-2018-20551: Fixed a reachable assertion which could allow a denial-of-service attack through specially crafted PDF files (bsc#1120496).\n- CVE-2018-20650: Fixed a reachable assertion which could allow denial-of-service through specially crafted PDF files (bsc#1120939).\n- CVE-2018-20662: Fixed a bug which could potentially crash the running process by SIGABRT resulting in a denial-of-service attack through a specially crafted PDF file (bsc#1120956).\n- CVE-2019-10871: Fixed a heap-based buffer  over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc (bsc#1131696).\n- CVE-2019-10872: Fixed a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc (bsc#1131722).\n- CVE-2019-14494: Fixed a divide-by-zero error in the function SplashOutputDev::tilingPatternFill (bsc#1143950).\n- CVE-2019-7310: Fixed a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) that allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document (bsc#1124150).\n- CVE-2019-9200: Fixed a heap-based buffer underwrite which could allow denial-of-service attack through a specially crafted PDF file (bsc#1127329)\n- CVE-2019-9631: Fixed a heap-based buffer over-read  in the CairoRescaleBox.cc downsample_row_box_filter function (bsc#1129202).\n- CVE-2019-9903: Fixed excessive stack consumption in the Dict::find() method, which can be triggered by passing a crafted pdf file to the pdfunite binary (bsc#1130229).\n- CVE-2019-9959: Fixed integer overflow that made it possible to allocate a large memory chunk on the heap with a size controlled by an attacker (bsc#1142465).\n- CVE-2020-27778: Fixed buffer overflow vulnerability in pdftohtml (bsc#1179163).\n  ","status":"published","published":"2021-12-01T16:00:36Z","modified":"2026-02-04T02:27:58.636078Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:1723-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2020-27778: Fixed a buffer overflow in pdftohtml (bsc#1179163).\n- CVE-2019-14494: Fixed a divide-by-zero error in pdftoppm (bsc#1143950).\n- CVE-2019-9959: Fixed an integer overflow in pdftocairo (bsc#1142465).\n- CVE-2019-10871: Fixed an invalid memory access in pdftops (bsc#1131696).\n- CVE-2019-10872: Fixed an invalid memory access in pdftoppm (bsc#1131722).\n- CVE-2019-9903: Fixed a buffer overflow in pdfunite (bsc#1130229).\n- CVE-2019-7310: Fixed an application crash in pdftocairo (bsc#1124150).\n- CVE-2019-9631: Fixed an invalid memory access in pdftocairo (bsc#1129202).\n","status":"published","published":"2022-05-18T14:52:59Z","modified":"2026-02-04T03:40:10.178002Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1724-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2020-27778: Fixed a buffer overflow in pdftohtml (bsc#1179163).\n- CVE-2019-14494: Fixed a divide-by-zero error in pdftoppm (bsc#1143950).\n- CVE-2019-9959: Fixed an integer overflow in pdftocairo (bsc#1142465).\n- CVE-2019-10871: Fixed an invalid memory access in pdftops (bsc#1131696).\n- CVE-2019-10872: Fixed an invalid memory access in pdftoppm (bsc#1131722).\n- CVE-2019-9903: Fixed a buffer overflow in pdfunite (bsc#1130229).\n- CVE-2019-7310: Fixed an application crash in pdftocairo (bsc#1124150).\n- CVE-2019-9631: Fixed an invalid memory access in pdftocairo (bsc#1129202).\n","status":"published","published":"2022-05-18T14:53:15Z","modified":"2026-02-04T03:57:45.462419Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-4646-1","title":"poppler vulnerabilities","description":"It was discovered that Poppler incorrectly handled certain files. If a user\nor automated system were tricked into opening a crafted PDF file, an\nattacker could cause a denial of service.\n","status":"published","published":"2020-11-25T18:03:42Z","modified":"2026-04-22T10:09:08.294095Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}