CVE-2017-9083

Name	CVE-2017-9083
Description	poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	863016

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
poppler (PTS)	bullseye	20.09.0-3.1+deb11u1	vulnerable
	bullseye (security)	20.09.0-3.1+deb11u2	vulnerable
	bookworm	22.12.0-2+deb12u1	vulnerable
	trixie	25.03.0-5	vulnerable
	forky, sid	25.03.0-11.1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
poppler	source	(unstable)	(unfixed)	unimportant		863016

https://bugs.freedesktop.org/show_bug.cgi?id=101084
Does not use JPX decoder but openjpeg; affected only source wise