Security update for poppler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1723-1 Final 1 1 2022-05-18T14:52:59Z current 2022-05-18T14:52:59Z 2022-05-18T14:52:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for poppler This update for poppler fixes the following issues: - CVE-2020-27778: Fixed a buffer overflow in pdftohtml (bsc#1179163). - CVE-2019-14494: Fixed a divide-by-zero error in pdftoppm (bsc#1143950). - CVE-2019-9959: Fixed an integer overflow in pdftocairo (bsc#1142465). - CVE-2019-10871: Fixed an invalid memory access in pdftops (bsc#1131696). - CVE-2019-10872: Fixed an invalid memory access in pdftoppm (bsc#1131722). - CVE-2019-9903: Fixed a buffer overflow in pdfunite (bsc#1130229). - CVE-2019-7310: Fixed an application crash in pdftocairo (bsc#1124150). - CVE-2019-9631: Fixed an invalid memory access in pdftocairo (bsc#1129202). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1723,SUSE-SLE-SDK-12-SP5-2022-1723,SUSE-SLE-SERVER-12-SP5-2022-1723 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ Link for SUSE-SU-2022:1723-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/011077.html E-Mail link for SUSE-SU-2022:1723-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1124150 SUSE Bug 1124150 https://bugzilla.suse.com/1129202 SUSE Bug 1129202 https://bugzilla.suse.com/1130229 SUSE Bug 1130229 https://bugzilla.suse.com/1131696 SUSE Bug 1131696 https://bugzilla.suse.com/1131722 SUSE Bug 1131722 https://bugzilla.suse.com/1142465 SUSE Bug 1142465 https://bugzilla.suse.com/1143950 SUSE Bug 1143950 https://bugzilla.suse.com/1179163 SUSE Bug 1179163 https://www.suse.com/security/cve/CVE-2019-10871/ SUSE CVE CVE-2019-10871 page https://www.suse.com/security/cve/CVE-2019-10872/ SUSE CVE CVE-2019-10872 page https://www.suse.com/security/cve/CVE-2019-14494/ SUSE CVE CVE-2019-14494 page https://www.suse.com/security/cve/CVE-2019-7310/ SUSE CVE CVE-2019-7310 page https://www.suse.com/security/cve/CVE-2019-9631/ SUSE CVE CVE-2019-9631 page https://www.suse.com/security/cve/CVE-2019-9903/ SUSE CVE CVE-2019-9903 page https://www.suse.com/security/cve/CVE-2019-9959/ SUSE CVE CVE-2019-9959 page https://www.suse.com/security/cve/CVE-2020-27778/ SUSE CVE CVE-2020-27778 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-cpp0-0.43.0-16.19.3 libpoppler-cpp0-32bit-0.43.0-16.19.3 libpoppler-cpp0-64bit-0.43.0-16.19.3 libpoppler-devel-0.43.0-16.19.3 libpoppler-glib-devel-0.43.0-16.19.3 libpoppler-glib8-0.43.0-16.19.3 libpoppler-glib8-32bit-0.43.0-16.19.3 libpoppler-glib8-64bit-0.43.0-16.19.3 libpoppler-qt4-4-0.43.0-16.19.3 libpoppler-qt4-4-32bit-0.43.0-16.19.3 libpoppler-qt4-4-64bit-0.43.0-16.19.3 libpoppler-qt4-devel-0.43.0-16.19.3 libpoppler-qt5-1-0.43.0-16.19.2 libpoppler-qt5-1-32bit-0.43.0-16.19.2 libpoppler-qt5-1-64bit-0.43.0-16.19.2 libpoppler-qt5-devel-0.43.0-16.19.2 libpoppler60-0.43.0-16.19.3 libpoppler60-32bit-0.43.0-16.19.3 libpoppler60-64bit-0.43.0-16.19.3 poppler-tools-0.43.0-16.19.3 typelib-1_0-Poppler-0_18-0.43.0-16.19.3 libpoppler-glib8-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server 12 SP5 libpoppler-qt4-4-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server 12 SP5 libpoppler60-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server 12 SP5 poppler-tools-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server 12 SP5 libpoppler-glib8-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpoppler-qt4-4-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpoppler60-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 poppler-tools-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpoppler-cpp0-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-devel-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-glib-devel-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-qt4-devel-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 typelib-1_0-Poppler-0_18-0.43.0-16.19.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. CVE-2019-10871 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-10871.html CVE-2019-10871 https://bugzilla.suse.com/1131696 SUSE Bug 1131696 An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc. CVE-2019-10872 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-10872.html CVE-2019-10872 https://bugzilla.suse.com/1131722 SUSE Bug 1131722 An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. CVE-2019-14494 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-14494.html CVE-2019-14494 https://bugzilla.suse.com/1143950 SUSE Bug 1143950 In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. CVE-2019-7310 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-7310.html CVE-2019-7310 https://bugzilla.suse.com/1124150 SUSE Bug 1124150 Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. CVE-2019-9631 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-9631.html CVE-2019-9631 https://bugzilla.suse.com/1129202 SUSE Bug 1129202 PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary. CVE-2019-9903 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-9903.html CVE-2019-9903 https://bugzilla.suse.com/1130229 SUSE Bug 1130229 The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo. CVE-2019-9959 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2019-9959.html CVE-2019-9959 https://bugzilla.suse.com/1142465 SUSE Bug 1142465 A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service. CVE-2020-27778 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.19.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.19.3 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.19.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221723-1/ https://www.suse.com/security/cve/CVE-2020-27778.html CVE-2020-27778 https://bugzilla.suse.com/1179163 SUSE Bug 1179163