{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"poppler","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NCQPZ97EZE11BWA499GA1M","modified_at":"2026-09-01T20:03:51.384622729Z","published_at":"2017-05-19T16:29:00.197Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2017-9083","https://security-tracker.debian.org/tracker/CVE-2017-9083"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2017-9083","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2017-9083"}],"summary":"poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation f"}