CVE catalog

CVE-2019-9545

poppler: CVE-2019-9545

Severity: Low · CVSS 3.3CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published: Mar 1, 2019, 7:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.82% · Oct 25, 2026

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	poppler	sid	`26.07.0-3`	vulnerable
Debian	poppler	forky	`26.07.0-3`	vulnerable
Debian	poppler	trixie	`25.03.0-5+deb13u4`	vulnerable
Debian	poppler	trixie-security	`25.03.0-5+deb13u3`	vulnerable
Debian	poppler	bookworm	`22.12.0-2+deb12u2`	vulnerable
Debian	poppler	bookworm-security	`22.12.0-2+deb12u3`	vulnerable
Suse	poppler	linux enterprise module for basesystem 15 sp4	`0.79.0-150200.3.26.1`	fixed
Suse	poppler	linux enterprise module for basesystem 15 sp5	`0.79.0-150200.3.26.1`	fixed
Suse	poppler	manager proxy 4.2	`0.79.0-150200.3.26.1`	fixed
Suse	poppler	manager server 4.2	`0.79.0-150200.3.26.1`	fixed
Opensuse	poppler	leap 15.4	`0.79.0-150200.3.26.1`	fixed
Opensuse	poppler	leap 15.4	`0.62.0-150000.4.31.1`	fixed
Ubuntu	poppler	pro	`0.80.0-0ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu3`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu4`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu5`	vulnerable
Ubuntu	poppler	pro	`0.85.0-1ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.85.0-1ubuntu3`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.2`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.3`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.4`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.5`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.6`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm2`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm3`	vulnerable
Ubuntu	poppler	22.04	`21.06.1-1`	vulnerable
Ubuntu	poppler	22.04	`21.11.0-1~ubuntu2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.1`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.3`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.4`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.5`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.6`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.7`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.8`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.9`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.10`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.11`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.12`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.13`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.14`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.15`	vulnerable
Ubuntu	poppler	24.04	`23.08.0-2ubuntu1`	vulnerable
Ubuntu	poppler	24.04	`23.12.0-1ubuntu2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu8`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.1`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.3`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.4`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.5`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.6`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.7`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.8`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.9`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.10`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.11`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-3`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-4`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-4build1`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-4ubuntu1`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-5`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-6`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-7`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-10`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-10ubuntu0.1`	vulnerable
Ubuntu	poppler	25.10	`25.03.0-10ubuntu0.2`	vulnerable
Ubuntu	poppler	26.10	`26.01.0-2build2`	vulnerable
Ubuntu	poppler	26.10	`26.01.0-5`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-0ubuntu1`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-2`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-2ubuntu1`	vulnerable
Ubuntu	poppler	26.10	`26.07.0-2ubuntu1.1`	vulnerable
Ubuntu	poppler	26.04	`25.03.0-10`	vulnerable
Ubuntu	poppler	26.04	`25.03.0-11.1`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2build2`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.1`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.2`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	poppler	source	sid	`(unfixed)`	low	Not reported	[923552]
Debian	poppler	source	forky	`(unfixed)`	low	Not reported	[923552]
Debian	poppler	source	trixie	`(unfixed)`	low	Not reported	[923552]
Debian	poppler	source	bookworm	`(unfixed)`	low	Not reported	[923552]
Suse	poppler	rpm	linux enterprise module for basesystem 15 sp4	`0.79.0-150200.3.26.1`	Not reported	SUSE-SU-2023:4562-1	Not reported
Suse	poppler	rpm	linux enterprise module for basesystem 15 sp5	`0.79.0-150200.3.26.1`	Not reported	SUSE-SU-2023:4562-1	Not reported
Suse	poppler	rpm	manager proxy 4.2	`0.79.0-150200.3.26.1`	Not reported	SUSE-SU-2023:4562-1	Not reported
Suse	poppler	rpm	manager server 4.2	`0.79.0-150200.3.26.1`	Not reported	SUSE-SU-2023:4562-1	Not reported
Opensuse	poppler	rpm	leap 15.4	`0.79.0-150200.3.26.1`	Not reported	SUSE-SU-2023:4562-1	Not reported
Opensuse	poppler	rpm	leap 15.4	`0.62.0-150000.4.31.1`	Not reported	SUSE-SU-2023:4270-1	Not reported

[Debian bug #923552]

Notes

[trixie] poppler: Minor issue [bookworm] poppler: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[gir1.2-poppler-0.18]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler126]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-cpp0v5]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-cpp-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-glib8]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-glib-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-glib-doc]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · all · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · all · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · all · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · all · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-private-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt5-1]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt5-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt6-3]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[libpoppler-qt6-dev]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[poppler-utils]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

[Debian 13 (Trixie)]

[gir1.2-poppler-0.18]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler147]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-cpp2]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-cpp-dev]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-dev]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13
[libpoppler-glib8t64]Unknown
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  dsa · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  dsa · poppler · debian · 13

Next results

Observed: Oct 23, 2026, 5:45:30 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]