GCVE - cpe:2.3:a:freedesktop:poppler:0.54.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:freedesktop:poppler:0.54.0:*:*:*:*:*:*:*

part: a version: 0.54.0 update: *

Vendor	Freedesktop (`2c544e5d-e68e-5b35-a616-dc08f0ba697e`)
Product	Poppler (`b2e9eefd-0d12-5535-9c38-bc4de43f056e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libpoppler-dev`	purl2cpe	2026-06-01 10:14:03.992461
`pkg:deb/ubuntu/libpoppler-dev`	purl2cpe	2026-06-01 10:14:03.992462
`pkg:freedesktop/poppler/poppler`	purl2cpe	2026-06-01 10:14:03.992464
`pkg:github/freedesktop/poppler`	purl2cpe	2026-06-01 10:14:03.992465
`pkg:rpm/fedora/poppler`	purl2cpe	2026-06-01 10:14:03.992466
`pkg:rpm/opensuse/poppler`	purl2cpe	2026-06-01 10:14:03.992468

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-9865`	vulnerable	2026-06-03 14:37:47.492719	Details available The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc. Published: 2017-06-25T13:00:00.000Z Updated: 2024-08-05T17:18:02.236Z Open on db.gcve.eu Reference links http://somevulnsofadlab.blogspot.com/2017/06/popplerstack-buffer-overflow-in.html https://bugs.freedesktop.org/show_bug.cgi?id=100774 https://www.debian.org/security/2018/dsa-4079 https://security.gentoo.org/glsa/201801-17 https://usn.ubuntu.com/4042-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9408`	vulnerable	2026-06-03 14:37:41.576650	Details available In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file. Published: 2017-06-02T19:00:00.000Z Updated: 2024-08-05T17:02:44.463Z Open on db.gcve.eu Reference links https://bugs.freedesktop.org/show_bug.cgi?id=100776 https://www.debian.org/security/2018/dsa-4079 https://security.gentoo.org/glsa/201801-17	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9406`	vulnerable	2026-06-03 14:37:41.576029	Details available In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file. Published: 2017-06-02T19:00:00.000Z Updated: 2024-08-05T17:02:44.386Z Open on db.gcve.eu Reference links https://www.debian.org/security/2018/dsa-4079 https://security.gentoo.org/glsa/201801-17 https://bugs.freedesktop.org/show_bug.cgi?id=100775	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9083`	vulnerable	2026-06-03 14:37:41.036553	Details available poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file. Published: 2017-05-19T16:00:00.000Z Updated: 2024-08-05T16:55:22.087Z Open on db.gcve.eu Reference links https://bugs.freedesktop.org/show_bug.cgi?id=101084 https://security.gentoo.org/glsa/201801-17	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7511`	vulnerable	2026-06-03 14:37:32.329999	Details available poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents. Published: 2017-05-30T18:00:00.000Z Updated: 2024-08-05T16:04:11.847Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201801-17 https://cgit.freedesktop.org/poppler/poppler/commit/?id=5c9b08a875b07853be6c44e43ff5f7f059df666a	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.