# CVE-2019-9903: poppler: Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es)... CVE-2019-9903 is fixed in 14 products on 1 platform, first by gir1.2-poppler-0.18 0.62.0-2ubuntu2.9, released May 22, 2019. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2019-9903 - Priority: Routine - CVSS: 6.5 (Moderate) - EPSS: 0.0241 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 20, 2019 ## Description Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc (CVE-2019-7310) * poppler: heap-based buffer overflow in function ImageStream::getLine() in Stream.cc (CVE-2019-9200) * poppler: heap-based buffer over-read in function PSOutputDev::checkPageSlice in PSOutputDev.cc (CVE-2019-10871) * poppler: heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc (CVE-2019-12293) * poppler: memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc (CVE-2018-18897) * poppler: NULL pointer dereference in the XRef::getEntry in XRef.cc (CVE-2018-20481) * poppler: reachable Object::getString assertion in AnnotRichMedia class in Annot.c (CVE-2018-20551) * poppler: reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc (CVE-2018-20650) * poppler: SIGABRT PDFDoc::setup class in PDFDoc.cc (CVE-2018-20662) * poppler: heap-based buffer over-read in function downsample_row_box_filter in CairoRescaleBox.cc (CVE-2019-9631) * poppler: stack consumption in function Dict::find() in Dict.cc (CVE-2019-9903) * poppler: integer overflow in JPXStream::init function leading to memory consumption (CVE-2019-9959) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | gir1.2-poppler-0.18 Ubuntu 18.04.6 LTS (bionic) | 0.62.0-2ubuntu2.9 | [gir1.2-poppler-0.18 0.62.0-2ubuntu2.9](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gir1.2-poppler-0.18-0.62.0-2ubuntu2.9.md) | May 22, 2019 | | Linux | libpoppler-cpp0v5 Ubuntu 18.04.6 LTS (bionic) | 0.62.0-2ubuntu2.9 | [libpoppler-cpp0v5 0.62.0-2ubuntu2.9](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpoppler-cpp0v5-0.62.0-2ubuntu2.9.md) | May 22, 2019 | | Linux | libpoppler-glib8 Ubuntu 18.04.6 LTS (bionic) | 0.62.0-2ubuntu2.9 | [libpoppler-glib8 0.62.0-2ubuntu2.9](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpoppler-glib8-0.62.0-2ubuntu2.9.md) | May 22, 2019 | | Linux | libpoppler-qt5-1 Ubuntu 18.04.6 LTS (bionic) | 0.62.0-2ubuntu2.9 | [libpoppler-qt5-1 0.62.0-2ubuntu2.9](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpoppler-qt5-1-0.62.0-2ubuntu2.9.md) | May 22, 2019 | | Linux | libpoppler73 Ubuntu 18.04.6 LTS (bionic) | 0.62.0-2ubuntu2.9 | [libpoppler73 0.62.0-2ubuntu2.9](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpoppler73-0.62.0-2ubuntu2.9.md) | May 22, 2019 | | Linux | poppler RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-cpp RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-cpp ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-cpp-devel RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-cpp-devel ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-devel RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-devel ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-glib RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-glib ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-glib-devel RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-glib-devel ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-qt5 RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-qt5 ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-qt5-devel RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-qt5-devel ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-utils RHEL 8 | 0:0.66.0-11.el8_0.12 | [RHSA-2019:2713](https://patchblox.com/security/data/fix/linux/rhsa-2019-2713.md) | Sep 12, 2019 | | Linux | poppler-utils Ubuntu 18.04.6 LTS (bionic) | 0.62.0-2ubuntu2.9 | [poppler-utils 0.62.0-2ubuntu2.9](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-poppler-utils-0.62.0-2ubuntu2.9.md) | May 22, 2019 | | Linux | poppler-utils ol 8 | 0:0.66.0-11.el8_0.12 | [ELSA-2019-2713](https://patchblox.com/security/data/fix/linux/elsa-2019-2713.md) | Sep 12, 2019 | --- Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.