CVE-2019-9200

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

• CWE-787

• http://www.securityfocus.com/bid/107172Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2022
• https://access.redhat.com/errata/RHSA-2019:2713
• https://gitlab.freedesktop.org/poppler/poppler/issues/728Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00008.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OSCOYM3AMFFBJWSBWY6VJVLNE5JD7YS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ6RABASMSIMMWMDZTP6ZWUWZPTBSVB5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWP5XSUG6GNRI75NYKF53KIB2CZY6QQ6/
• https://research.loginsoft.com/bugs/heap-based-buffer-underwrite-in-imagestreamgetline-poppler-0-74-0/Exploit, Third Party Advisory
• https://usn.ubuntu.com/3905-1/Third Party Advisory
• https://usn.ubuntu.com/4042-1/
• http://www.securityfocus.com/bid/107172Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2022
• https://access.redhat.com/errata/RHSA-2019:2713
• https://gitlab.freedesktop.org/poppler/poppler/issues/728Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/03/msg00008.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OSCOYM3AMFFBJWSBWY6VJVLNE5JD7YS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ6RABASMSIMMWMDZTP6ZWUWZPTBSVB5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWP5XSUG6GNRI75NYKF53KIB2CZY6QQ6/
• https://research.loginsoft.com/bugs/heap-based-buffer-underwrite-in-imagestreamgetline-poppler-0-74-0/Exploit, Third Party Advisory
• https://usn.ubuntu.com/3905-1/Third Party Advisory
• https://usn.ubuntu.com/4042-1/

Published

Feb 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" f…
• CVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability…
• CVE-2019-9195util/src/zip.rs in Grin before 1.0.2 mishandles suspicious f…9.8
• CVE-2019-9196The Face authentication component in Aware mobile liveness 2…
• CVE-2019-9197The com.unity3d.kharma protocol handler in Unity Editor 2018…8.8
• CVE-2019-9199PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.…
• CVE-2019-9201Multiple Phoenix Contact devices allow remote attackers to e…9.8
• CVE-2019-9202Nagios IM (component of Nagios XI) before 2.2.7 allows authe…8.8
• CVE-2019-9203Authorization bypass in Nagios IM (component of Nagios XI) b…9.8
• CVE-2019-9204SQL injection vulnerability in Nagios IM (component of Nagio…9.8
• CVE-2019-9206PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/…6.1
• CVE-2019-9207PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.…6.1