High severity7.5NVD Advisory· Published Oct 2, 2017· Updated Jun 17, 2026

CVE-2017-14977

Description

The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.

Affected products

Xorg/Poppler
cpe:2.3:a:freedesktop:poppler:0.59.0:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Poppler (software)/Popplerllm-fuzzy
Range: =0.59.0
osv-coords15 versions
pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/poppler&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/poppler-qt&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/poppler-qt&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/poppler-qt&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/poppler-qt&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3
< 0.24.4-14.13.1+ 14 more
- (no CPE)range: < 0.24.4-14.13.1
- (no CPE)range: < 0.43.0-16.15.1
- (no CPE)range: < 0.12.3-1.13.3.2
- (no CPE)range: < 0.24.4-14.13.1
- (no CPE)range: < 0.43.0-16.15.1
- (no CPE)range: < 0.24.4-14.13.1
- (no CPE)range: < 0.12.3-1.13.3.2
- (no CPE)range: < 0.24.4-14.13.1
- (no CPE)range: < 0.43.0-16.15.1
- (no CPE)range: < 0.12.3-1.13.3.2
- (no CPE)range: < 0.24.4-14.13.1
- (no CPE)range: < 0.43.0-16.15.1
- (no CPE)range: < 0.43.0-16.15.1
- (no CPE)range: < 0.43.0-16.15.1
- (no CPE)range: < 0.43.0-16.15.1

Patches

Vulnerability mechanics

References

bugs.freedesktop.org/show_bug.cginvdExploitIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2017/11/msg00023.htmlnvdMailing ListThird Party Advisory
www.debian.org/security/2018/dsa-4079nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000