CVE-2019-9200: High severity Freedesktop poppler vulnerability
Published Feb 26, 2019
·Updated
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Affected Software
7 affected componentsFixes available
Freedesktop poppler=0.74.0
Debian Debian Linux=8.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
debian/poppler
20.09.0-3.1+deb11u120.09.0-3.1+deb11u222.12.0-2+deb12u125.03.0-5+deb13u225.03.0-11.1
Remediation
Event History
Feb 26, 2019
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Feb 27, 2019
Data Sourced
via Red Hat·12:23 PM
DescriptionSeverityAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·01:27 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·01:28 AM
Description
Data Sourced
via Debian·01:28 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2019-9200?
CVE-2019-9200 is a heap-based buffer underwrite vulnerability in Poppler 0.74.0.
2
How does CVE-2019-9200 affect Poppler?
CVE-2019-9200 allows an attacker to cause Denial of Service (Segmentation fault) or possibly have other unspecified impacts.
3
Which software versions are affected by CVE-2019-9200?
Poppler 0.74.0 is affected by CVE-2019-9200.
4
How severe is CVE-2019-9200?
CVE-2019-9200 has a severity score of 8.8 (high severity).
5
How can I fix CVE-2019-9200?
Update Poppler to version 0.71.0-5 or later to fix CVE-2019-9200.