Vulnerabilities (CVE)

Filtered by vendor Freedesktop Subscribe
Total 134 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-37051 2 Debian, Freedesktop 2 Debian Linux, Poppler 2023-12-10 N/A 6.5 MEDIUM
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
CVE-2022-37050 2 Debian, Freedesktop 2 Debian Linux, Poppler 2023-12-10 N/A 6.5 MEDIUM
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
CVE-2020-18839 1 Freedesktop 1 Poppler 2023-12-10 N/A 6.5 MEDIUM
Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.
CVE-2023-34872 1 Freedesktop 1 Poppler 2023-12-10 N/A 5.5 MEDIUM
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
CVE-2020-23804 2 Debian, Freedesktop 2 Debian Linux, Poppler 2023-12-10 N/A 7.5 HIGH
Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.
CVE-2022-38349 1 Freedesktop 1 Poppler 2023-12-10 N/A 6.5 MEDIUM
An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.
CVE-2020-36024 1 Freedesktop 1 Poppler 2023-12-10 N/A 5.5 MEDIUM
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.
CVE-2022-37052 1 Freedesktop 1 Poppler 2023-12-10 N/A 6.5 MEDIUM
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
CVE-2020-36023 1 Freedesktop 1 Poppler 2023-12-10 N/A 6.5 MEDIUM
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
CVE-2022-4055 1 Freedesktop 1 Xdg-utils 2023-12-10 N/A 7.4 HIGH
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
CVE-2022-38171 2 Freedesktop, Xpdfreader 2 Poppler, Xpdf 2023-12-10 N/A 7.8 HIGH
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
CVE-2022-38784 3 Debian, Fedoraproject, Freedesktop 3 Debian Linux, Fedora, Poppler 2023-12-10 N/A 7.8 HIGH
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
CVE-2022-27337 3 Debian, Fedoraproject, Freedesktop 3 Debian Linux, Fedora, Poppler 2023-12-10 4.3 MEDIUM 6.5 MEDIUM
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVE-2022-1215 1 Freedesktop 1 Libinput 2023-12-10 7.2 HIGH 7.8 HIGH
A format string vulnerability was found in libinput
CVE-2022-31782 1 Freedesktop 1 Freetype Demo Programs 2023-12-10 6.8 MEDIUM 7.8 HIGH
ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.
CVE-2020-27748 1 Freedesktop 1 Xdg-utils 2023-12-10 4.3 MEDIUM 6.5 MEDIUM
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird.
CVE-2015-1877 2 Debian, Freedesktop 2 Debian Linux, Xdg-utils 2023-12-10 6.8 MEDIUM 8.8 HIGH
The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.
CVE-2020-16126 1 Freedesktop 1 Accountsservice 2023-12-10 2.1 LOW 3.3 LOW
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
CVE-2020-27778 3 Debian, Freedesktop, Redhat 3 Debian Linux, Poppler, Enterprise Linux 2023-12-10 5.0 MEDIUM 7.5 HIGH
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
CVE-2021-3185 1 Freedesktop 1 Gst-plugins-bad 2023-12-10 7.5 HIGH 9.8 CRITICAL
A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution.