Freedesktop vulnerabilities

Products

• Poppler 96
• Dbus 24
• Xdg-utils 6
• Udisks 5
• Libinput 4
• Accountsservice 3
• Gst-plugins-good 3
• Dbus-glib 2
• Libbsd 2
• Policykit 2
• Polkit 2

Newest

• freedesktop poppler Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash() CVE-2026-107705 Fix available 8.3 HighOctober 8, 2026
• freedesktop poppler Freedesktop Poppler SplashClip.cc clipToPath integer overflow CVE-2026-102621 Fix available 4.8 MediumSeptember 29, 2026
• freedesktop poppler Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow CVE-2026-102620 Fix available 4.8 MediumSeptember 29, 2026
• freedesktop poppler Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow CVE-2026-93314 Fix available 5.3 MediumSeptember 18, 2026
• freedesktop poppler Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow CVE-2026-93313 Fix available 5.3 MediumSeptember 18, 2026
• freedesktop poppler Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference CVE-2026-93312 Fix available 5.3 MediumSeptember 18, 2026
• freedesktop poppler Freedesktop Poppler SampledFunction Function.cc integer overflow CVE-2026-93311 Fix available 5.3 MediumSeptember 18, 2026
• freedesktop libinput In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output... CVE-2026-50292 Fix available 7.4 HighJune 4, 2026
• freedesktop gst-plugins-good, gstreamer good plug-ins +1 more An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio... CVE-2026-46470 Fix available 4.0 MediumMay 14, 2026
• freedesktop gst-plugins-good, gstreamer good plug-ins +1 more An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio... CVE-2026-46469 Fix available 4.0 MediumMay 14, 2026
• freedesktop libinput, fedoraproject fedora, red hat enterprise linux 10 +3 more +5 more Libinput: libinput: information disclosure via dangling pointer in lua plugin handling CVE-2026-35094 Fix available 3.3 LowApril 1, 2026
• freedesktop libinput, fedoraproject fedora, red hat enterprise linux 10 +3 more +5 more Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins CVE-2026-35093 Fix available 8.8 HighApril 1, 2026
• freedesktop polkit, red hat enterprise linux 10, enterprise linux 6 +7 more +9 more Polkit: polkit: denial of service via unbounded input processing through standard input CVE-2026-4897 Fix available 5.5 MediumMarch 26, 2026
• gstreamer, debian linux, freedesktop gst-plugins-good +6 more +8 more Gstreamer: incomplete fix of cve-2026-1940 CVE-2026-1940 Fix available 5.1 MediumMarch 23, 2026
• freedesktop udisks, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 more Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api CVE-2026-26104 Fix available 5.5 MediumFebruary 25, 2026
• freedesktop udisks, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 more Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api CVE-2026-26103 Fix available 7.1 HighFebruary 25, 2026
• freedesktop poppler Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply... CVE-2025-43718 Fix available 2.9 LowOctober 1, 2025
• freedesktop poppler An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an... CVE-2025-50420 Public exploitFix available 6.5 MediumAugust 4, 2025
• freedesktop poppler Poppler Use After Free Vulnerability CVE-2025-52886 Fix available 5.5 MediumJuly 2, 2025
• freedesktop xdg-utils xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which... CVE-2025-52968 Disputed 2.7 LowJune 23, 2025
• freedesktop poppler NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures... CVE-2025-43903 Fix available 4.3 MediumApril 18, 2025
• freedesktop poppler Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the... CVE-2025-32365 Fix available 4.0 MediumApril 5, 2025
• freedesktop poppler A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an... CVE-2025-32364 Fix available 4.0 MediumApril 5, 2025
• freedesktop poppler libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the... CVE-2024-56378 Fix available 4.3 MediumDecember 22, 2024
• freedesktop poppler, red hat enterprise linux 10, enterprise linux 6 +4 more +6 more Poppler: pdfinfo: crash in broken documents when using -dests parameter CVE-2024-6239 Fix available 7.5 HighJune 21, 2024
• freedesktop poppler An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead... CVE-2022-38349 Fix available 6.5 MediumAugust 22, 2023
• freedesktop poppler A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of... CVE-2022-37052 Fix available 6.5 MediumAugust 22, 2023
• freedesktop poppler, debian linux +1 more An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of... CVE-2022-37051 Fix available 6.5 MediumAugust 22, 2023
• freedesktop poppler, debian linux +1 more In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service... CVE-2022-37050 Fix available 6.5 MediumAugust 22, 2023
• freedesktop poppler, debian linux +1 more Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause... CVE-2020-23804 Fix available 7.5 HighAugust 22, 2023
• freedesktop poppler Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause... CVE-2020-18839 Fix available 6.5 MediumAugust 22, 2023
• freedesktop poppler An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause... CVE-2020-36024 Fix available 5.5 MediumAugust 11, 2023
• freedesktop poppler An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause... CVE-2020-36023 Fix available 6.5 MediumAugust 11, 2023
• freedesktop poppler A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a... CVE-2023-34872 Fix available 5.5 MediumJuly 31, 2023
• freedesktop dbus, debian linux, fedoraproject fedora +3 more +5 more D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged... CVE-2023-34969 Fix available 6.5 MediumJune 8, 2023
• freedesktop xdg-utils When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can... CVE-2022-4055 Fix available 7.4 HighNovember 18, 2022
• freedesktop dbus, fedoraproject fedora +1 more An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x... CVE-2022-42012 Fix available 6.5 MediumOctober 6, 2022
• freedesktop dbus, fedoraproject fedora +1 more An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x... CVE-2022-42011 Fix available 6.5 MediumOctober 6, 2022
• freedesktop dbus, fedoraproject fedora +1 more An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x... CVE-2022-42010 Fix available 6.5 MediumOctober 6, 2022
• freedesktop poppler, debian linux, fedoraproject fedora +2 more Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder ... CVE-2022-38784 Fix available 7.8 HighAugust 30, 2022
• xpdfreader xpdf, freedesktop poppler +1 more Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream:... CVE-2022-38171 Fix available 7.8 HighAugust 22, 2022
• freedesktop freetype demo programs ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. CVE-2022-31782 Fix available 7.8 HighMay 27, 2022
• freedesktop poppler, debian linux, fedoraproject fedora +2 more A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial... CVE-2022-27337 Fix available 6.5 MediumMay 5, 2022
• freedesktop libinput A format string vulnerability was found in libinput CVE-2022-1215 Fix available 7.8 HighApril 20, 2022
• apple ios, ipados, macos +6 more +8 more An integer overflow was addressed with improved input validation CVE-2021-30860 In KEVPublic exploitFix available EPSS 76.0% 7.8 HighAugust 24, 2021
• freedesktop dbus A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the... CVE-2020-35512 Fix available 7.8 HighFebruary 15, 2021
• freedesktop gst-plugins-bad, gstreamer +1 more A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when... CVE-2021-3185 Fix available 9.8 CriticalJanuary 18, 2021
• freedesktop poppler DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a... CVE-2020-35702 Disputed 7.8 HighDecember 25, 2020
• freedesktop poppler, debian linux, redhat enterprise linux +2 more A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote... CVE-2020-27778 Fix available 7.5 HighNovember 25, 2020
• freedesktop xdg-utils A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling... CVE-2020-27748 Fix available 6.5 MediumNovember 24, 2020
• Show olderLoading…