Freedesktop
88 CVEs across 23 Freedesktop products. Browse Freedesktop vulnerabilities, severities, and proof-of-concept exploits.
Freedesktop products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50292 | High | 7.4 | 2026-06-04 | In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execu… |
CVE-2026-46470 | Medium | 4.0 | 2026-05-14 | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not su… |
CVE-2026-46469 | Medium | 4.0 | 2026-05-14 | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not su… |
CVE-2026-35094 | Low | 3.3 | 2026-04-01 | A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. T… |
CVE-2026-35093 | High | 8.8 | 2026-04-01 | A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypa… |
CVE-2026-4897 | Medium | 5.5 | 2026-03-26 | A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary… |
CVE-2026-1940 | Medium | 5.1 | 2026-03-23 | An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > si… |
CVE-2026-26104 | Medium | 5.5 | 2026-02-25 | A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occ… |
CVE-2026-26103 | High | 7.1 | 2026-02-25 | A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization… |
CVE-2025-43718 | Low | 2.9 | 2025-10-01 | Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) o… |
CVE-2025-50420 | Medium | 6.5 | 2025-08-04 | An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can… |
CVE-2025-52886 | Medium | 5.9 | 2025-07-02 | Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is po… |
CVE-2025-52968 | Low | 2.7 | 2025-06-23 | xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified t… |
CVE-2025-43903 | Medium | 4.3 | 2025-04-18 | NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. |
CVE-2025-32365 | Medium | 4.0 | 2025-04-05 | Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced… |
CVE-2025-32364 | Medium | 4.0 | 2025-04-05 | A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated… |
CVE-2024-56378 | Medium | 4.3 | 2024-12-23 | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. |
CVE-2024-6239 | High | 7.5 | 2024-06-21 | A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files… |
CVE-2022-38349 | Medium | 6.5 | 2023-08-22 | An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDo… |
CVE-2022-37052 | Medium | 6.5 | 2023-08-22 | A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. |
CVE-2022-37051 | Medium | 6.5 | 2023-08-22 | An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream… |
CVE-2022-37050 | Medium | 6.5 | 2023-08-22 | In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in… |
CVE-2020-23804 | High | 7.5 | 2023-08-22 | Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. |
CVE-2020-18839 | Medium | 6.5 | 2023-08-22 | Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service. |
CVE-2020-36024 | Medium | 5.5 | 2023-08-11 | An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C… |
CVE-2020-36023 | Medium | 6.5 | 2023-08-11 | An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C… |
CVE-2023-34872 | Medium | 5.5 | 2023-07-31 | A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in Outlin… |
CVE-2023-34969 | Medium | 6.5 | 2023-06-08 | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedeskt… |
CVE-2022-4055 | High | 7.4 | 2022-11-19 | When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that sho… |
CVE-2022-42012 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42011 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42010 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-38784 | High | 7.8 | 2022-08-30 | Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a spec… |
CVE-2022-38171 | High | 7.8 | 2022-08-22 | Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially craft… |
CVE-2022-31782 | High | 7.8 | 2022-06-02 | ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. |
CVE-2022-1215 | High | 7.8 | 2022-06-02 | A format string vulnerability was found in libinput |
CVE-2022-27337 | Medium | 6.5 | 2022-05-05 | A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. |
CVE-2021-30860 | High | 7.8 | 2021-08-24 | An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big… |
CVE-2015-1877 | High | 8.8 | 2021-06-02 | The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote… |
CVE-2020-27748 | Medium | 6.5 | 2021-06-01 | A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added v… |
CVE-2020-35512 | High | 7.8 | 2021-02-15 | A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 whe… |
CVE-2021-3185 | Critical | 9.8 | 2021-01-26 | A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be sm… |
CVE-2020-35702 | High | 7.8 | 2020-12-25 | DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only… |
CVE-2020-27778 | High | 7.5 | 2020-12-03 | A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file… |
CVE-2020-16127 | Low | 2.8 | 2020-11-11 | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations… |
CVE-2020-16126 | Low | 3.3 | 2020-11-11 | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing u… |
CVE-2020-12049 | Medium | 5.5 | 2020-06-08 | An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the p… |
CVE-2012-2142 | High | 7.8 | 2020-01-09 | The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a ter… |
CVE-2019-20367 | Critical | 9.1 | 2020-01-08 | nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). |
CVE-2010-4654 | High | 7.8 | 2019-11-13 | poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack. |
CVE-2010-4653 | Medium | 6.5 | 2019-11-13 | An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts. |
CVE-2018-21009 | High | 8.8 | 2019-09-05 | Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. |
CVE-2019-14494 | High | 7.5 | 2019-08-01 | An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. |
CVE-2019-9959 | Medium | 6.5 | 2019-07-22 | The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making i… |
CVE-2019-12749 | High | 7.1 | 2019-06-11 | dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, us… |
CVE-2019-12293 | High | 8.8 | 2019-05-23 | In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. |
CVE-2019-11026 | Medium | 6.5 | 2019-04-08 | FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. |
CVE-2019-10873 | Medium | 6.5 | 2019-04-05 | An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc. |
CVE-2019-10872 | High | 8.8 | 2019-04-05 | An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc. |
CVE-2019-10871 | Medium | 6.5 | 2019-04-05 | An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. |
CVE-2019-9903 | Medium | 6.5 | 2019-03-21 | PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which… |
CVE-2019-9631 | Critical | 9.8 | 2019-03-08 | Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. |
CVE-2019-9545 | High | 8.8 | 2019-03-01 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a… |
CVE-2019-9543 | High | 8.8 | 2019-03-01 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sendin… |
CVE-2019-9200 | High | 8.8 | 2019-02-26 | A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted… |
CVE-2019-7310 | High | 7.8 | 2019-02-03 | In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to caus… |
CVE-2018-20662 | Medium | 6.5 | 2019-01-03 | In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong r… |
CVE-2018-20650 | Medium | 6.5 | 2019-01-01 | A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as… |
CVE-2018-20551 | Medium | 6.5 | 2018-12-28 | A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation as… |
CVE-2018-20481 | Medium | 6.5 | 2018-12-26 | XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer deref… |
CVE-2018-19149 | Medium | 6.5 | 2018-11-10 | Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment. |
CVE-2018-19060 | Medium | 6.5 | 2018-11-07 | An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdf… |
CVE-2018-19059 | Medium | 6.5 | 2018-11-07 | An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by u… |
CVE-2018-19058 | Medium | 6.5 | 2018-11-07 | An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a… |
CVE-2018-18897 | Medium | 6.5 | 2018-11-02 | An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo. |
CVE-2018-17336 | High | 7.8 | 2018-09-22 | UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a d… |
CVE-2018-16646 | Medium | 6.5 | 2018-09-06 | In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS at… |
CVE-2017-2626 | Medium | 5.2 | 2018-07-27 | It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using… |
CVE-2018-13988 | Medium | 6.5 | 2018-07-25 | Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by… |
CVE-2018-14036 | Medium | 6.5 | 2018-07-13 | Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() i… |
CVE-2017-18267 | Medium | 5.5 | 2018-05-10 | The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via… |
CVE-2017-18266 | High | 8.8 | 2018-05-10 | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment vari… |
CVE-2018-10768 | Medium | 6.5 | 2018-05-06 | There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2017-1000456 | High | 8.8 | 2018-01-02 | freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations. |
CVE-2017-15565 | High | 8.8 | 2017-10-17 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document. |
CVE-2017-14977 | High | 7.5 | 2017-10-02 | The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table p… |
CVE-2017-14976 | High | 7.5 | 2017-10-02 | The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary… |
CVE-2017-14975 | High | 7.5 | 2017-10-02 | The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initial… |
CVE-2017-14929 | High | 7.5 | 2017-09-30 | In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx… |
CVE-2017-14928 | Medium | 5.5 | 2017-09-30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document. |
CVE-2017-14927 | Medium | 5.5 | 2017-09-30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document. |
CVE-2017-14926 | Medium | 5.5 | 2017-09-30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document. |
CVE-2017-14617 | High | 7.8 | 2017-09-20 | In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF fi… |
CVE-2017-14520 | High | 7.8 | 2017-09-17 | In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF… |
CVE-2017-14519 | High | 7.5 | 2017-09-17 | In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx… |
CVE-2017-14518 | High | 7.8 | 2017-09-17 | In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document. |
CVE-2017-14517 | Medium | 5.5 | 2017-09-17 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document. |
CVE-2017-2820 | High | 8.8 | 2017-07-12 | An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF fi… |
CVE-2017-2818 | High | 7.5 | 2017-07-12 | An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large… |