Security update for poppler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0495-1 Final 1 1 2023-02-23T11:48:40Z current 2023-02-23T11:48:40Z 2023-02-23T11:48:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for poppler This update for poppler fixes the following issues: - CVE-2022-38784: Fixed integer overflow in the JBIG2 decoder (bsc#1202692). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-495,SUSE-SLE-Module-Basesystem-15-SP4-2023-495,SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-495,openSUSE-SLE-15.4-2023-495 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230495-1/ Link for SUSE-SU-2023:0495-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013872.html E-Mail link for SUSE-SU-2023:0495-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202692 SUSE Bug 1202692 https://www.suse.com/security/cve/CVE-2022-38784/ SUSE CVE CVE-2022-38784 page SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP4 openSUSE Leap 15.4 libpoppler-cpp0-22.01.0-150400.3.3.1 libpoppler-cpp0-32bit-22.01.0-150400.3.3.1 libpoppler-cpp0-64bit-22.01.0-150400.3.3.1 libpoppler-devel-22.01.0-150400.3.3.1 libpoppler-glib-devel-22.01.0-150400.3.3.1 libpoppler-glib8-22.01.0-150400.3.3.1 libpoppler-glib8-32bit-22.01.0-150400.3.3.1 libpoppler-glib8-64bit-22.01.0-150400.3.3.1 libpoppler-qt5-1-22.01.0-150400.3.3.1 libpoppler-qt5-1-32bit-22.01.0-150400.3.3.1 libpoppler-qt5-1-64bit-22.01.0-150400.3.3.1 libpoppler-qt5-devel-22.01.0-150400.3.3.1 libpoppler-qt6-3-22.01.0-150400.3.3.1 libpoppler-qt6-devel-22.01.0-150400.3.3.1 libpoppler117-22.01.0-150400.3.3.1 libpoppler117-32bit-22.01.0-150400.3.3.1 libpoppler117-64bit-22.01.0-150400.3.3.1 poppler-tools-22.01.0-150400.3.3.1 typelib-1_0-Poppler-0_18-22.01.0-150400.3.3.1 libpoppler-cpp0-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libpoppler-devel-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libpoppler-glib-devel-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libpoppler-glib8-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libpoppler117-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 poppler-tools-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 typelib-1_0-Poppler-0_18-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libpoppler-cpp0-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libpoppler-devel-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libpoppler-qt5-1-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libpoppler-qt5-devel-22.01.0-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libpoppler-cpp0-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-cpp0-32bit-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-devel-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-glib-devel-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-glib8-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-glib8-32bit-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-qt5-1-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-qt5-1-32bit-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-qt5-devel-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-qt6-3-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler-qt6-devel-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler117-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 libpoppler117-32bit-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 poppler-tools-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 typelib-1_0-Poppler-0_18-22.01.0-150400.3.3.1 as a component of openSUSE Leap 15.4 Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf. CVE-2022-38784 SUSE Linux Enterprise Module for Basesystem 15 SP4:libpoppler-cpp0-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libpoppler-devel-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libpoppler-glib-devel-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libpoppler-glib8-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libpoppler117-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:poppler-tools-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:typelib-1_0-Poppler-0_18-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:libpoppler-cpp0-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:libpoppler-devel-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:libpoppler-qt5-1-22.01.0-150400.3.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:libpoppler-qt5-devel-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-cpp0-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-cpp0-32bit-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-devel-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-glib-devel-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-glib8-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-glib8-32bit-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-qt5-1-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-qt5-1-32bit-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-qt5-devel-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-qt6-3-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler-qt6-devel-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler117-22.01.0-150400.3.3.1 openSUSE Leap 15.4:libpoppler117-32bit-22.01.0-150400.3.3.1 openSUSE Leap 15.4:poppler-tools-22.01.0-150400.3.3.1 openSUSE Leap 15.4:typelib-1_0-Poppler-0_18-22.01.0-150400.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230495-1/ https://www.suse.com/security/cve/CVE-2022-38784.html CVE-2022-38784 https://bugzilla.suse.com/1202692 SUSE Bug 1202692 https://bugzilla.suse.com/1203392 SUSE Bug 1203392