108
CVEs
4
Critical
36
High
1
KEV
60
PoC
29
Unpatched C/H
39.8%
Patch Rate
2.5%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
36
MEDIUM
56
LOW
12
Monthly CVE Trend
Affected Products (30)
Poppler
68
Debian Linux
32
Ubuntu Linux
23
Dbus
17
Fedora
16
Enterprise Linux
10
Opensuse
9
Enterprise Linux Server
7
Enterprise Linux Workstation
7
Enterprise Linux Desktop
7
Enterprise Linux Server Tus
6
Enterprise Linux Server Aus
6
D Bus
5
Ubuntu
5
Enterprise Linux Eus
4
Udisks
4
Libinput
4
Accountsservice
3
Mageia
3
Jwt Attack
2
Polkit
2
Enterprise Linux Server Eus
2
Gst Plugins Good
2
Openshift Container Platform
2
Ansible Tower
2
Xpdfreader
2
Xpdf
2
Gtk
1
Libdbus
1
Solaris
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2012-3524 | libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the. Rated medium severity (CVSS 6.9). Public exploit code available and EPSS exploitation probability 52.4%. | MEDIUM | 6.9 | 52.4% | 107 |
PoC
|
| CVE-2013-4474 | Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 25.4%. | MEDIUM | 5.0 | 25.4% | 70 |
PoC
No patch
|
| CVE-2017-2820 | An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.9% | 65 |
PoC
No patch
|
| CVE-2017-15565 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.6% | 65 |
PoC
No patch
|
| CVE-2019-9200 | A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 3.5% | 64 |
PoC
No patch
|
| CVE-2019-9543 | An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 3.3% | 64 |
PoC
No patch
|
| CVE-2019-9545 | An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.8% | 64 |
PoC
No patch
|
| CVE-2019-10872 | An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.7% | 64 |
PoC
No patch
|
| CVE-2019-12293 | In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.5% | 64 |
PoC
No patch
|
| CVE-2013-4473 | Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 2.3% | 60 |
PoC
No patch
|
| CVE-2017-14518 | In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.3% | 59 |
PoC
No patch
|
| CVE-2017-14520 | In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.2% | 59 |
PoC
No patch
|
| CVE-2018-17336 | UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.6% | 59 |
PoC
No patch
|
| CVE-2019-7310 | In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 2.2% | 59 |
PoC
No patch
|
| CVE-2020-35702 | DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.9% | 59 |
PoC
No patch
|