CVE-2017-9406

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.freedesktop.org/show_bug.cgi?id=100775Issue Tracking, Vendor Advisory
https://security.gentoo.org/glsa/201801-17Third Party Advisory
https://www.debian.org/security/2018/dsa-4079Third Party Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=100775Issue Tracking, Vendor Advisory
https://security.gentoo.org/glsa/201801-17Third Party Advisory
https://www.debian.org/security/2018/dsa-4079Third Party Advisory

Timeline

Published: Jun 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-94076.5In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.CVE-2017-94086.5In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a d CVE-2017-94096.5In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.CVE-2017-94125.5The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory CVE-2017-94138.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the aut CVE-2017-94148.8Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the CVE-2017-94157.5Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack th CVE-2017-94166.5Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local fi CVE-2017-94179.8Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.CVE-2017-94188.8SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands CVE-2017-94196.1Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inj CVE-2017-94206.1Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrar