CVE catalog

CVE-2019-9959

poppler: CVE-2019-9959

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.91% · Oct 25, 2026

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpopplersid26.07.0-3fixed
Debianpopplerforky26.07.0-3fixed
Debianpopplertrixie25.03.0-5+deb13u4fixed
Debianpopplertrixie-security25.03.0-5+deb13u3fixed
Debianpopplerbookworm22.12.0-2+deb12u2fixed
Debianpopplerbookworm-security22.12.0-2+deb12u3fixed
Alpinepoppler3.100.71.0-r1fixed
Alpinepoppler3.110.80.0-r0fixed
Alpinepoppler3.120.80.0-r0fixed
Alpinepoppler3.130.80.0-r0fixed
Alpinepoppler3.140.80.0-r0fixed
Alpinepoppler3.150.80.0-r0fixed
Alpinepoppler3.160.80.0-r0fixed
Alpinepoppler3.170.80.0-r0fixed
Alpinepoppler3.180.80.0-r0fixed
Alpinepoppler3.190.80.0-r0fixed
Alpinepoppler3.200.80.0-r0fixed
Alpinepoppler3.210.80.0-r0fixed
Alpinepoppler3.220.80.0-r0fixed
Alpinepoppler3.230.80.0-r0fixed
Alpinepoppler3.240.80.0-r0fixed
Alpinepoppler3.70.56.0-r1fixed
Alpinepoppler3.80.56.0-r2fixed
Alpinepoppler3.90.56.0-r2fixed
Ubuntupoppler16.040.33.0-0ubuntu3vulnerable
Ubuntupoppler16.040.37.0-0ubuntu1vulnerable
Ubuntupoppler16.040.38.0-0ubuntu1vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.1vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.2vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.3vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.4vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.5vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.6vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.7vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.8vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.9vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.10vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.11vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.12vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.13vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.14vulnerable
Ubuntupoppler16.040.41.0-0ubuntu1.15fixed
Ubuntuemscripten16.041.22.1-1build1vulnerable
Ubuntupoppler18.040.57.0-2ubuntu4vulnerable
Ubuntupoppler18.040.57.0-2ubuntu5vulnerable
Ubuntupoppler18.040.62.0-1ubuntu1vulnerable
Ubuntupoppler18.040.62.0-2ubuntu1vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.1vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.2vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.4vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.5vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.6vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.7vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.8vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.9vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.10vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.11fixed
Ubuntuemscripten18.041.22.1-1build1vulnerable
Ubuntuemscripten22.042.0.13~dfsg-1vulnerable
Ubuntuemscripten22.043.1.1~dfsg+~1.39.6-5ubuntu4vulnerable
Ubuntuemscripten22.043.1.2~dfsg+~1.39.6-6ubuntu1vulnerable
Ubuntuemscripten22.043.1.3~dfsg-4ubuntu1vulnerable
Ubuntuemscripten22.043.1.3~dfsg-5ubuntu1vulnerable
Ubuntuemscripten22.043.1.4~dfsg-7ubuntu1vulnerable
Ubuntuemscripten22.043.1.5~dfsg-3ubuntu1vulnerable
Ubuntuemscripten24.043.1.6~dfsg-5vulnerable
Ubuntuemscripten24.043.1.6~dfsg-6vulnerable
Ubuntuemscripten24.043.1.6~dfsg-7vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpopplersourcesid0.85.0-2lowNot reported[941776]
Debianpopplersourceforky0.85.0-2lowNot reported[941776]
Debianpopplersourcetrixie0.85.0-2lowNot reported[941776]
Debianpopplersourcebookworm0.85.0-2lowNot reported[941776]
Alpinepopplerapk3.100.71.0-r1Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.110.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.120.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.130.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.140.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.150.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.160.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.170.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.180.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.190.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.200.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.210.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.220.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.230.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.240.80.0-r0Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.70.56.0-r1Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.80.56.0-r2Not reportedALPINE-CVE-2019-9959Not reported
Alpinepopplerapk3.90.56.0-r2Not reportedALPINE-CVE-2019-9959Not reported
Ubuntupopplerdeb16.040.41.0-0ubuntu1.15Not reportedUBUNTU-CVE-2019-9959Not reported
Ubuntupopplerdeb18.040.62.0-2ubuntu2.11Not reportedUBUNTU-CVE-2019-9959Not reported

[Debian bug #941776]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • [libpoppler126]Unknown

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · all · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · all · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · all · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · all · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

  • [poppler-utils]Unknown

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · bookworm; dsa · poppler · debian · 12

[Debian 13 (Trixie)]

  • Source package: [poppler]

    Details (4)
    • 25.03.0-5+deb13u4 · amd64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u4 · arm64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

  • [libpoppler147]Unknown

    Source package: [poppler]

    Details (4)
    • 25.03.0-5+deb13u4 · amd64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u4 · arm64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

  • Source package: [poppler]

    Details (4)
    • 25.03.0-5+deb13u4 · amd64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u4 · arm64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

  • Source package: [poppler]

    Details (4)
    • 25.03.0-5+deb13u4 · amd64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u4 · arm64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

  • Source package: [poppler]

    Details (4)
    • 25.03.0-5+deb13u4 · amd64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u4 · arm64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

  • Source package: [poppler]

    Details (4)
    • 25.03.0-5+deb13u4 · amd64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u4 · arm64 · trixie

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

    • 25.03.0-5+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 0.85.0-2

      dsa · poppler · debian · 13

Next results

Observed:

References