CVE-2024-7868 | High | 8.2 | 2024-08-15 | In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file… |
CVE-2024-7867 | Medium | 6.2 | 2024-08-15 | In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero. |
CVE-2024-7866 | Medium | 5.5 | 2024-08-15 | In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. |
CVE-2024-4976 | Medium | 5.5 | 2024-05-15 | Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference. |
CVE-2024-4568 | Low | 2.9 | 2024-05-06 | In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. |
CVE-2024-4141 | Low | 2.9 | 2024-04-24 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being… |
CVE-2024-3900 | Low | 2.9 | 2024-04-17 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.
|
CVE-2024-3248 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.
|
CVE-2024-3247 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow.
|
CVE-2024-2971 | Low | 2.9 | 2024-03-26 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference in the input PDF file.
|
CVE-2022-48545 | Medium | 5.5 | 2023-08-22 | An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02. |
CVE-2023-3436 | Low | 3.3 | 2023-06-27 | Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
|
CVE-2023-3044 | Low | 3.3 | 2023-06-02 | An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.
Thi… |
CVE-2023-2664 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.
|
CVE-2023-2663 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.
|
CVE-2023-2662 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.
|
CVE-2023-26930 | Medium | 5.5 | 2023-04-26 | Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Ve… |
CVE-2022-45587 | Medium | 5.5 | 2023-02-15 | Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service. |
CVE-2022-45586 | Medium | 5.5 | 2023-02-15 | Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service. |
CVE-2021-36493 | High | 7.5 | 2023-02-03 | Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command. |
CVE-2022-43071 | Medium | 5.5 | 2022-11-15 | A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. |
CVE-2022-43295 | Medium | 5.5 | 2022-11-14 | XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795. |
CVE-2022-41844 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 an… |
CVE-2022-41843 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928. |
CVE-2022-41842 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc. |
CVE-2022-38222 | High | 7.8 | 2022-09-29 | There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for examp… |
CVE-2022-38928 | High | 7.8 | 2022-09-21 | XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393. |
CVE-2022-38334 | Medium | 5.5 | 2022-09-15 | XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc. |
CVE-2022-36561 | Medium | 5.5 | 2022-08-30 | XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538. |
CVE-2022-38171 | High | 7.8 | 2022-08-22 | Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially craft… |
CVE-2022-33108 | High | 7.8 | 2022-06-28 | XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files. |
CVE-2021-27548 | Medium | 5.5 | 2022-05-18 | There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03. |
CVE-2022-30775 | Medium | 5.5 | 2022-05-16 | xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm b… |
CVE-2022-30524 | High | 7.8 | 2022-05-09 | There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinat… |
CVE-2022-27135 | Medium | 5.5 | 2022-04-25 | xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentatio… |
CVE-2021-30860 | High | 7.8 | 2021-08-24 | An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big… |
CVE-2020-35376 | High | 7.5 | 2020-12-26 | Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function. |
CVE-2020-25725 | Medium | 5.0 | 2020-11-21 | In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-us… |
CVE-2020-24999 | High | 7.8 | 2020-09-03 | There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml… |
CVE-2020-24996 | High | 7.8 | 2020-09-03 | There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a… |
CVE-2012-2142 | High | 7.8 | 2020-01-09 | The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a ter… |
CVE-2010-0207 | Medium | 5.5 | 2019-10-30 | In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers. |
CVE-2010-0206 | Medium | 5.5 | 2019-10-30 | xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objects. |
CVE-2019-10026 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the psOpRoll case. |
CVE-2019-10025 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits. |
CVE-2019-10024 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters. |
CVE-2019-10023 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpMod case. |
CVE-2019-10022 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc. |
CVE-2019-10021 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps. |
CVE-2019-10020 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters. |
CVE-2019-10019 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes. |
CVE-2019-10018 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case. |
CVE-2019-9878 | High | 7.8 | 2019-03-21 | There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can b… |
CVE-2019-9877 | High | 7.8 | 2019-03-21 | There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be trigge… |
CVE-2018-18651 | Medium | 5.5 | 2018-10-25 | An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by large loop) via a sp… |
CVE-2018-18650 | Medium | 5.5 | 2018-10-25 | An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service (Integer Overflow) via a crafted /Size val… |
CVE-2018-18459 | Medium | 5.5 | 2018-10-18 | The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf fi… |
CVE-2018-18458 | Medium | 5.5 | 2018-10-18 | The function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf… |
CVE-2018-18457 | Medium | 5.5 | 2018-10-18 | The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf fi… |
CVE-2018-18456 | Medium | 5.5 | 2018-10-18 | The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buf… |
CVE-2018-18455 | Medium | 5.5 | 2018-10-18 | The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf fil… |
CVE-2018-18454 | Medium | 5.5 | 2018-10-18 | CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file… |
CVE-2018-16369 | Medium | 5.5 | 2018-09-03 | XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack consumption) via a crafted pdf file, related to AcroForm::scanF… |
CVE-2018-16368 | Medium | 5.5 | 2018-09-03 | SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafte… |
CVE-2018-11033 | High | 7.8 | 2018-05-14 | The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash… |
CVE-2018-8107 | Medium | 5.5 | 2018-03-14 | The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via… |
CVE-2018-8106 | Medium | 5.5 | 2018-03-14 | The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application… |
CVE-2018-8105 | Medium | 5.5 | 2018-03-14 | The JPXStream::fillReadBuf function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application cras… |
CVE-2018-8104 | Medium | 5.5 | 2018-03-14 | The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via… |
CVE-2018-8103 | Medium | 5.5 | 2018-03-14 | The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and applic… |
CVE-2018-8102 | Medium | 5.5 | 2018-03-14 | The JBIG2MMRDecoder::getBlackCode function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (buffer over-read and application crash)… |
CVE-2018-8101 | Medium | 5.5 | 2018-03-14 | The JPXStream::inverseTransformLevel function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and applic… |
CVE-2018-8100 | High | 7.8 | 2018-03-14 | The JPXStream::readTilePart function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer overflow and application cras… |
CVE-2018-7455 | Medium | 5.5 | 2018-02-24 | An out-of-bounds read in JPXStream::readTilePart in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstr… |
CVE-2018-7454 | Medium | 5.5 | 2018-02-24 | A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstra… |
CVE-2018-7453 | Medium | 5.5 | 2018-02-24 | Infinite recursion in AcroForm::scanField in AcroForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file due to lack of loop… |
CVE-2018-7452 | Medium | 5.5 | 2018-02-24 | A NULL pointer dereference in JPXStream::fillReadBuf in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demo… |
CVE-2018-7175 | Medium | 5.5 | 2018-02-15 | An issue was discovered in xpdf 4.00. A NULL pointer dereference in readCodestream allows an attacker to cause denial of service via a JPX image with zero comp… |
CVE-2018-7174 | Medium | 5.5 | 2018-02-15 | An issue was discovered in xpdf 4.00. An infinite loop in XRef::Xref allows an attacker to cause denial of service because loop detection exists only for table… |
CVE-2018-7173 | Medium | 5.5 | 2018-02-15 | A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding. |
CVE-2010-3702 | | | 2010-11-05 | The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly othe… |
CVE-2007-3387 | | | 2007-07-30 | Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdeg… |