CVE-2008-2950
Fixed in a distro release EPSS 15%
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
Products: poppler
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | poppler | 0.8.4-1.1 |
| Debian 13 | poppler | 0.8.4-1.1 |
| Debian 14 | poppler | 0.8.4-1.1 |
| Debian 5.0 | poppler | 0.8.2-2+lenny1 |
| openSUSE Tumbleweed | poppler | 21.08.0-1.3 |