Fluid Attacks Database

Description

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	poppler	>=0 <0.85.0-2	0.85.0-2
debian 13	poppler	>=0 <0.85.0-2	0.85.0-2
debian 11	poppler	>=0 <0.85.0-2	0.85.0-2
debian 12	poppler	>=0 <0.85.0-2	0.85.0-2
rpm rhel8	poppler	<0:0.66.0-11.el8_0.12	0:0.66.0-11.el8_0.12

Aliases

1. CVE-2019-99032. NVD-2019-99033. OSV-DEBIAN-2019-99034. OSV-2019-99035. SECURITY-TRACKER-CVE-2019-9903

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.