Search for vulnerabilities
Vulnerability details: VCID-qhqf-quyk-aaaf
Vulnerability ID VCID-qhqf-quyk-aaaf
Aliases CVE-2008-2950
Summary The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
generic_textual MODERATE http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.10975 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.16326 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32036 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
epss 0.32853 https://api.first.org/data/v1/epss?cve=CVE-2008-2950
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=454277
generic_textual MODERATE http://secunia.com/advisories/31167
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2008-2950
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-2950.json
https://api.first.org/data/v1/epss?cve=CVE-2008-2950
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2950
http://secunia.com/advisories/30963
http://secunia.com/advisories/31002
http://secunia.com/advisories/31167
http://secunia.com/advisories/31267
http://secunia.com/advisories/31405
http://security.gentoo.org/glsa/glsa-200807-04.xml
http://securityreason.com/securityalert/3977
https://exchange.xforce.ibmcloud.com/vulnerabilities/43619
https://www.exploit-db.com/exploits/6032
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00161.html
http://wiki.rpath.com/Advisories:rPSA-2008-0223
http://www.mandriva.com/security/advisories?name=MDVSA-2008:146
http://www.ocert.org/advisories/ocert-2008-007.html
http://www.securityfocus.com/archive/1/493980/100/0/threaded
http://www.securityfocus.com/archive/1/494142/100/0/threaded
http://www.securityfocus.com/bid/30107
http://www.securitytracker.com/id?1020435
http://www.ubuntu.com/usn/usn-631-1
http://www.vupen.com/english/advisories/2008/2024/references
454277 https://bugzilla.redhat.com/show_bug.cgi?id=454277
489756 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489756
cpe:2.3:a:poppler:poppler:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:poppler:poppler:*:*:*:*:*:*:*:*
CVE-2008-2950 https://nvd.nist.gov/vuln/detail/CVE-2008-2950
GLSA-200807-04 https://security.gentoo.org/glsa/200807-04
OSVDB-46806;CVE-2008-2950 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/6032.py
USN-631-1 https://usn.ubuntu.com/631-1/
Data source Exploit-DB
Date added July 7, 2008
Description Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution
Ransomware campaign use Known
Source publication date July 8, 2008
Exploit type local
Platform linux
Source update date Dec. 14, 2016
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2008-2950
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.92784
EPSS Score 0.10975
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.