UnratedFix available
Fix CVE(s): CVE-2024-6239
Type: advisorySources: OSV
* SECURITY UPDATE: crash in pdfinfo -dests on broken documents: printDestinations() wrapped the destination name returned by Catalog::getDestNameTreeName() / Catalog::getDestsName() into a new GooString before testing it, so a document whose name tree is short or whose /Dests entry is not a dictionary made both getters return NULL and the GooString constructor dereference it, crashing pdfinfo. - debian/patches/CVE-2024-6239.patch: read the raw name pointer first and only build the GooString once name, dest and dest->isPageRef() have all been checked, in utils/pdfinfo.cc; matches upstream commit 0554731. - CVE-2024-6239
- Products
- gir1.2-poppler-0.18, libpoppler-cpp-dev, libpoppler-cpp0v5, libpoppler-dev, libpoppler-glib-dev, libpoppler-glib-doc, libpoppler-glib8, libpoppler-private-dev, libpoppler-qt5-1, libpoppler-qt5-dev, libpoppler73, poppler-utils
- Affected versions
- Not specified
- Fixed versions
- 0.62.0-2ubuntu2.14+tuxcare.els1
- CVEs
- CVE-2024-6239
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:09 UTC · Revision 1
Source evidence
* SECURITY UPDATE: crash in pdfinfo -dests on broken documents: printDestinations() wrapped the destination name returned by Catalog::getDestNameTreeName() / Catalog::getDestsName() into a new GooString before testing it, so a document whose name tree is short or whose /Dests entry is not a dictionary made both getters return NULL and the GooString constructor dereference it, crashing pdfinfo. - debian/patches/CVE-2024-6239.patch: read the raw name pointer first and only build the GooString once name, dest and dest->isPageRef() have all been checked, in utils/pdfinfo.cc; matches upstream commit 0554731. - CVE-2024-6239
osv:CLSA-2026-1787396206
gir1.2-poppler-0.18
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-cpp-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-cpp0v5
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-glib-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-glib-doc
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-glib8
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-private-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-qt5-1
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler-qt5-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
libpoppler73
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
poppler-utils
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els1
Complete source record
{
"id": "b9c975b3659341b9558abfb4a63c7fc956b0e96158e4e7ed97bb772b9d85dc24",
"url": "https://osv.dev/vulnerability/CLSA-2026-1787396206",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2024-6239",
"summary": "* SECURITY UPDATE: crash in pdfinfo -dests on broken documents: printDestinations() wrapped the destination name returned by Catalog::getDestNameTreeName() / Catalog::getDestsName() into a new GooString before testing it, so a document whose name tree is short or whose /Dests entry is not a dictionary made both getters return NULL and the GooString constructor dereference it, crashing pdfinfo. - debian/patches/CVE-2024-6239.patch: read the raw name pointer first and only build the GooString once name, dest and dest->isPageRef() have all been checked, in utils/pdfinfo.cc; matches upstream commit 0554731. - CVE-2024-6239",
"evidence": "osv:CLSA-2026-1787396206",
"products": [
{
"name": {
"value": "gir1.2-poppler-0.18",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-cpp-dev",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-cpp0v5",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-dev",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-glib-dev",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-glib-doc",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-glib8",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-private-dev",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-qt5-1",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-qt5-dev",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler73",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler-utils",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els1",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1787396206",
"aliases": [
"CLSA-2026-1787396206"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "gir1.2-poppler-0.18",
"purl": "pkg:deb/tuxcare/gir1.2-poppler-0.18?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-cpp-dev",
"purl": "pkg:deb/tuxcare/libpoppler-cpp-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-cpp0v5",
"purl": "pkg:deb/tuxcare/libpoppler-cpp0v5?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-dev",
"purl": "pkg:deb/tuxcare/libpoppler-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-glib-dev",
"purl": "pkg:deb/tuxcare/libpoppler-glib-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-glib-doc",
"purl": "pkg:deb/tuxcare/libpoppler-glib-doc?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-glib8",
"purl": "pkg:deb/tuxcare/libpoppler-glib8?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-private-dev",
"purl": "pkg:deb/tuxcare/libpoppler-private-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-qt5-1",
"purl": "pkg:deb/tuxcare/libpoppler-qt5-1?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler-qt5-dev",
"purl": "pkg:deb/tuxcare/libpoppler-qt5-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "libpoppler73",
"purl": "pkg:deb/tuxcare/libpoppler73?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els1"
}
]
}
],
"package": {
"name": "poppler-utils",
"purl": "pkg:deb/tuxcare/poppler-utils?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787396206.json"
}
}
],
"modified": "2026-10-26T09:31:47.702939593Z",
"provider": "osv",
"upstream": [
"CVE-2024-6239"
],
"references": [
"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787396206.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-6239"
]
},
"related_cves": [
{
"value": "CVE-2024-6239",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448508,
"published_at": "2026-08-22T10:56:56+00:00"
}