CVE-2019-9903: canonical ubuntu_linux Out-of-bounds Write

CVSS: 6.5v3.1MediumModified

AliasesUBUNTU-CVE-2019-9903DEBIAN-CVE-2019-9903

Published 21-03-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-9903 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 2.41% chance of exploitation in the next 30 days, higher than 83.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

2.41%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 8 · Related 4

DLA-3120-1 MGASA-2019-0244 MGASA-2019-0245 OPENSUSE-SU-2021:3854-1 RHSA-2019:2713 SUSE-SU-2021:3854-1+2 more

Timeline

21-03-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

CVSS metrics

5 scores · 3 sources · 3 versions

v3.16.5v3.06.5v2.04.3

EPSS trend

Probability

2.41%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

0.00 pp

From 2.41% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (gitlab.freedesktop.org)
Maturity: unknown
referenceUnverified
Exploit Reference (research.loginsoft.com)
Maturity: unknown