CVE-2012-2142

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-09 · updated 2026-06-16

Description

The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.

Affected products

poppler: before 0.21.4 — fixed in 0.21.4
Opensuse: 12.2
Red Hat Enterprise Linux: 5.0, 6.0
Xpdf: 3.02

How to fix

Upgrade to a fixed version: poppler 0.21.4. Check the vendor advisory for mitigations.

References

http://cgit.freedesktop.org/poppler/poppler/commit/?id=71bad47ed6a36d825b0d08992c8db56845c71e40
http://cgit.freedesktop.org/poppler/poppler/commit/NEWS?id=2bc48d5369f1dbecfc4db2878f33bdeb80d8d90f
http://lists.opensuse.org/opensuse-updates/2013-08/msg00049.html
http://www.openwall.com/lists/oss-security/2013/08/09/5
http://www.openwall.com/lists/oss-security/2013/08/09/6
https://bugzilla.redhat.com/show_bug.cgi?id=789936
http://cgit.freedesktop.org/poppler/poppler/commit/?id=71bad47ed6a36d825b0d08992c8db56845c71e40
http://cgit.freedesktop.org/poppler/poppler/commit/NEWS?id=2bc48d5369f1dbecfc4db2878f33bdeb80d8d90f
http://lists.opensuse.org/opensuse-updates/2013-08/msg00049.html
http://www.openwall.com/lists/oss-security/2013/08/09/5
http://www.openwall.com/lists/oss-security/2013/08/09/6
https://bugzilla.redhat.com/show_bug.cgi?id=789936

Get alerted when CVE-2012-2142 or the next vulnerability affects your stack