Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2012-2142: Poppler before 0.21.4 can run attacker commands
CVE-2012-2142 · published 6 years ago
Summary
The Poppler software that processes PDF files can be tricked by a specially crafted PDF to run commands on your computer. This could let someone take control of the system or steal data. Upgrade Poppler to version 0.21.4 or later and apply any security updates to stop the risk.
What to do
- Update debian poppler to version 0.18.4-7.
- Update freedesktop poppler to version 0.21.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | poppler |
< 0.18.4-7 Fix: upgrade to 0.18.4-7
|
| Debian:13 | debian | poppler |
< 0.18.4-7 Fix: upgrade to 0.18.4-7
|
| Debian:14 | debian | poppler |
< 0.18.4-7 Fix: upgrade to 0.18.4-7
|
| – | freedesktop | poppler |
< 0.21.4 cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:* |
| – | xpdfreader | xpdf |
3.02 cpe:2.3:a:xpdfreader:xpdf:3.02:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
5.0 6.0 cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| – | opensuse | opensuse |
12.2 cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* |
Original advisory text
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.
References
- https://security-tracker.debian.org/tracker/CVE-2012-2142 Vendor Advisory
- http://cgit.freedesktop.org/poppler/poppler/commit/?id=71bad47ed6a36d825b0d08992... Patch Vendor Advisory
- http://cgit.freedesktop.org/poppler/poppler/commit/NEWS?id=2bc48d5369f1dbecfc4db... Patch Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00049.html Mailing List Patch Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/08/09/5 Exploit Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/08/09/6 Exploit Mailing List Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=789936 Issue Tracking Third Party Advisory
Severity
7.8
High
Timeline
Published9 Jan 2020
Updated31 Oct 2026
First seen3 Sep 2026
Track software like this
Free during beta