CVE catalog

CVE-2019-9543

poppler: CVE-2019-9543

Severity: Medium
Published: Mar 1, 2019, 7:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 3.31% · Oct 25, 2026

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	poppler	sid	`26.07.0-3`	vulnerable
Debian	poppler	forky	`26.07.0-3`	vulnerable
Debian	poppler	trixie	`25.03.0-5+deb13u4`	vulnerable
Debian	poppler	trixie-security	`25.03.0-5+deb13u3`	vulnerable
Debian	poppler	bookworm	`22.12.0-2+deb12u2`	vulnerable
Debian	poppler	bookworm-security	`22.12.0-2+deb12u3`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu3`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu4`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu5`	vulnerable
Ubuntu	poppler	pro	`0.85.0-1ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.85.0-1ubuntu3`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.2`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.3`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.4`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.5`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.6`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm2`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm3`	vulnerable
Ubuntu	poppler	22.04	`21.06.1-1`	vulnerable
Ubuntu	poppler	22.04	`21.11.0-1~ubuntu2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.1`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.3`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.4`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.5`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.6`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.7`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.8`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.9`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.10`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.11`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.12`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.13`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.14`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.15`	vulnerable
Ubuntu	poppler	24.04	`23.08.0-2ubuntu1`	vulnerable
Ubuntu	poppler	24.04	`23.12.0-1ubuntu2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu8`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.1`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.3`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.4`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.5`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.6`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.7`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.8`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.9`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.10`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.11`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-3`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-4`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-4build1`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-4ubuntu1`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-5`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-6`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-7`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-10`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-10ubuntu0.1`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-10ubuntu0.2`	vulnerable
Ubuntu	poppler	26.10	`26.01.0-2build2`	vulnerable
Ubuntu	poppler	26.10	`26.01.0-5`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-0ubuntu1`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-2`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-2ubuntu1`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-2ubuntu1.1`	vulnerable
Ubuntu	poppler	26.04	`25.03.0-10`	vulnerable
Ubuntu	poppler	26.04	`25.03.0-11.1`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2build2`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.1`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.2`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	poppler	source	sid	`(unfixed)`	low	Not reported	[923553]
Debian	poppler	source	forky	`(unfixed)`	low	Not reported	[923553]
Debian	poppler	source	trixie	`(unfixed)`	low	Not reported	[923553]
Debian	poppler	source	bookworm	`(unfixed)`	low	Not reported	[923553]

[Debian bug #923553]

Notes

[trixie] poppler: Minor issue [bookworm] poppler: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[gir1.2-poppler-0.18]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler126]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-cpp0v5]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-cpp-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-glib8]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-glib-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-glib-doc]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · all · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · all · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · all · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · all · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-private-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt5-1]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt5-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt6-3]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt6-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[poppler-utils]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

[Debian 13 (Trixie)]

[gir1.2-poppler-0.18]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler147]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-cpp2]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-cpp-dev]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-dev]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-glib8t64]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13

Next results

Observed: Oct 23, 2026, 5:45:30 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]