OESA-2023-1612

Dashboard / Vulnerabilities / OESA-2023-1612

OESA-2023-1612

Summary: poppler security update

Details: Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \ the PDF viewers of the open source GNOME and KDE desktop environments. Security Fix(es): Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804) In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050) An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051) A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052) An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1612, https://nvd.nist.gov/vuln/detail/CVE-2020-23804, https://nvd.nist.gov/vuln/detail/CVE-2022-37050, https://nvd.nist.gov/vuln/detail/CVE-2022-37051, https://nvd.nist.gov/vuln/detail/CVE-2022-37052, https://nvd.nist.gov/vuln/detail/CVE-2022-38349