CVE-2019-7310

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

• CWE-125
• CWE-681

• http://www.securityfocus.com/bid/106829Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2022Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2713Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797Issue Tracking, Permissions Required, Third Party Advisory
• https://gitlab.freedesktop.org/poppler/poppler/issues/717Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00008.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00014.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BI7NLDN2HUEU4ZW3D7XPHOAEGT2CKDRO/
• https://usn.ubuntu.com/3886-1/Third Party Advisory
• http://www.securityfocus.com/bid/106829Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2022Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2713Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797Issue Tracking, Permissions Required, Third Party Advisory
• https://gitlab.freedesktop.org/poppler/poppler/issues/717Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00008.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00014.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BI7NLDN2HUEU4ZW3D7XPHOAEGT2CKDRO/
• https://usn.ubuntu.com/3886-1/Third Party Advisory

Published

Feb 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7304Canonical snapd before version 2.37.1 incorrectly performed …9.8
• CVE-2019-7305Information Exposure vulnerability in eXtplorer makes the /u…9.8
• CVE-2019-7306Byobu Apport hook may disclose sensitive information since i…7.5
• CVE-2019-7307Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubun…7
• CVE-2019-7308kernel/bpf/verifier.c in the Linux kernel before 4.20.6 perf…
• CVE-2019-7309In the GNU C Library (aka glibc or libc6) through 2.29, the …
• CVE-2019-7311An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 d…
• CVE-2019-7312Limited plaintext disclosure exists in PRIMX Zed Entreprise …
• CVE-2019-7313www/resource.py in Buildbot before 1.8.1 allows CRLF injecti…
• CVE-2019-7314liblivemedia in Live555 before 2019.02.03 mishandles the ter…
• CVE-2019-7315Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camer…
• CVE-2019-7316An issue was discovered in CSS-TRICKS Chat2 through 2015-05-…