Debian Security Advisory

DLA-1706-1 poppler -- LTS security update

Date Reported:
08 Mar 2019
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 913177, Bug 917325, Bug 918158, Bug 921215, Bug 923414.
In Mitre's CVE dictionary: CVE-2018-19058, CVE-2018-20481, CVE-2018-20662, CVE-2019-7310, CVE-2019-9200.
More information:

Several security vulnerabilities were discovered in the poppler PDF rendering shared library.

  • CVE-2018-19058

    A reachable abort in Object.h will lead to denial-of-service because EmbFile::save2 in lacks a stream check before saving an embedded file.

  • CVE-2018-20481

    Poppler mishandles unallocated XRef entries, which allows remote attackers to cause a denial-of-service (NULL pointer dereference) via a crafted PDF document.

  • CVE-2018-20662

    Poppler allows attackers to cause a denial-of-service (application crash and segmentation fault by crafting a PDF file in which an xref data structure is corrupted.

  • CVE-2019-7310

    A heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

  • CVE-2019-9200

    A heap-based buffer underwrite exists in ImageStream::getLine() located at that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause denial-of-service (segmentation fault) or possibly have unspecified other impact.

For Debian 8 Jessie, these problems have been fixed in version 0.26.5-2+deb8u8.

We recommend that you upgrade your poppler packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: