Medium
Security advisory
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-9359
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:26 UTC · Revision 1
Source evidence
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
osv:CVE-2020-9359
Complete source record
{
"id": "cebf25e843021c1cb57d3671903f14e2cc5a8cd97133dd5029c60d210ce57ded",
"url": "https://osv.dev/vulnerability/CVE-2020-9359",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-9359",
"summary": "KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.",
"evidence": "osv:CVE-2020-9359",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-9359",
"aliases": [
"CVE-2020-9359"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/kde/okular",
"type": "GIT",
"events": [
{
"introduced": "f7f2b3105fbc59830c5153f59b63e1f6c6c5c6be"
},
{
"fixed": "81c005710cdbb23f9ed9ebcc4aee4db69d33434d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:kde:okular:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.12.0"
},
{
"fixed": "19.12.3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v19.12.2",
"v19.12.1",
"v19.12.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9359.json",
"vanir_signatures": [
{
"id": "CVE-2020-9359-00a4aafa",
"digest": {
"length": 727,
"function_hash": "26823166276780174318208233458442789712"
},
"source": "https://github.com/kde/okular/commit/81c005710cdbb23f9ed9ebcc4aee4db69d33434d",
"target": {
"file": "core/page.cpp",
"function": "PagePrivate::imageRotationDone"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-9359-5c9e0945",
"digest": {
"threshold": 0.9,
"line_hashes": [
"103477504479933573462645002385604803675",
"174608747667283521650042549385698051925",
"336346411585471588962494241290132846721",
"106443721749238156279133402094561450340",
"152334232973350142638199216814253405009",
"260759493130988424377960062138205595341",
"130747372222879974200963138800771149558",
"25975057783018457561650396263621492751",
"146460686465375423733051567751044411027",
"49875568837799417773098985493878237559",
"210122222813725661431340495021618530640",
"9294599941181623443229732043776791921",
"101842513946858533376564493503601166395",
"3192522789925630668787452212783594524",
"236299577573811057078399850161616446577"
]
},
"source": "https://github.com/kde/okular/commit/81c005710cdbb23f9ed9ebcc4aee4db69d33434d",
"target": {
"file": "core/page.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-9359-7dcc545b",
"digest": {
"length": 679,
"function_hash": "55452390609546155863547246059151910967"
},
"source": "https://github.com/kde/okular/commit/81c005710cdbb23f9ed9ebcc4aee4db69d33434d",
"target": {
"file": "core/page.cpp",
"function": "Page::hasPixmap"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-9359-a744e7a5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292196443006284438470786731231660970249",
"128579163328239113586340907204660594120",
"43136393125989925144730966015402196533",
"253142715234395562416841977251878011371"
]
},
"source": "https://github.com/kde/okular/commit/81c005710cdbb23f9ed9ebcc4aee4db69d33434d",
"target": {
"file": "core/page_p.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-9359-b15c9847",
"digest": {
"length": 914,
"function_hash": "194474271673894041429572684263239600264"
},
"source": "https://github.com/kde/okular/commit/81c005710cdbb23f9ed9ebcc4aee4db69d33434d",
"target": {
"file": "core/page.cpp",
"function": "PagePrivate::setPixmap"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:24:38Z"
}
}
],
"modified": "2026-10-24T14:24:38.135776100Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TY3O6UWX2XTP7PISPTZ6FYRDFU4UF66/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AW6GJ3AKGXOMTDHNZBMSXDTWNJJRFBDH/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G3HL3F6JLCSRLPFZ47735F5STPJWDVR4/",
"https://kde.org/info/security/advisory-20200312-1.txt",
"https://lists.debian.org/debian-lts-announce/2020/03/msg00033.html",
"https://lists.debian.org/debian-lts-announce/2021/12/msg00019.html",
"https://security.gentoo.org/glsa/202007-47",
"https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:kde:okular:*:*:*:*:*:*:*:*"
],
"vendor_product": "kde:okular",
"extracted_events": [
{
"range": [
{
"fixed": "1.10.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-9359",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443710,
"published_at": "2020-03-24T14:15:13.577+00:00"
}