Security update for poppler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2907-1 Final 1 1 2023-07-20T08:20:53Z current 2023-07-20T08:20:53Z 2023-07-20T08:20:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for poppler This update for poppler fixes the following issues: - CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272). - CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635). - CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105). - CVE-2018-20481: Fixed memory leak in GfxColorSpace:setDisplayProfile in GfxState.cc (bsc#1114966). - CVE-2019-7310: Fixed a heap-based buffer over-read allows remote attackers to cause DOS via a special crafted PDF (bsc#1124150). - CVE-2018-13988: Fixed buffer overflow in pdfunite (bsc#1102531). - CVE-2018-16646: Fixed infinite recursion in poppler/Parser.cc:Parser::getObj() function (bsc#1107597). - CVE-2018-19058: Fixed reachable abort in Object.h leading to denial of service (bsc#1115187). - CVE-2018-19059: Fixed out-of-bounds read in EmbFile:save2 in FileSpec.cc leading to denial of service (bsc#1115186). - CVE-2018-19060: Fixed NULL pointer dereference in goo/GooString.h leading to denial of service (bsc#1115185). - CVE-2018-19149: Fixed NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment (bsc#1115626). - CVE-2017-18267: Fixed denial of service (infinite recursion) via a crafted PDF file (bsc#1092945). - CVE-2018-20650: Fixed issue where a reachable Object in dictLookup assertion allows attackers to cause DOS (bsc#1120939). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2907,SUSE-SLE-SDK-12-SP5-2023-2907,SUSE-SLE-SERVER-12-SP5-2023-2907 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ Link for SUSE-SU-2023:2907-1 https://lists.suse.com/pipermail/sle-updates/2023-July/030446.html E-Mail link for SUSE-SU-2023:2907-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1092945 SUSE Bug 1092945 https://bugzilla.suse.com/1102531 SUSE Bug 1102531 https://bugzilla.suse.com/1107597 SUSE Bug 1107597 https://bugzilla.suse.com/1114966 SUSE Bug 1114966 https://bugzilla.suse.com/1115185 SUSE Bug 1115185 https://bugzilla.suse.com/1115186 SUSE Bug 1115186 https://bugzilla.suse.com/1115187 SUSE Bug 1115187 https://bugzilla.suse.com/1115626 SUSE Bug 1115626 https://bugzilla.suse.com/1120939 SUSE Bug 1120939 https://bugzilla.suse.com/1124150 SUSE Bug 1124150 https://bugzilla.suse.com/1136105 SUSE Bug 1136105 https://bugzilla.suse.com/1149635 SUSE Bug 1149635 https://bugzilla.suse.com/1199272 SUSE Bug 1199272 https://www.suse.com/security/cve/CVE-2017-18267/ SUSE CVE CVE-2017-18267 page https://www.suse.com/security/cve/CVE-2018-13988/ SUSE CVE CVE-2018-13988 page https://www.suse.com/security/cve/CVE-2018-16646/ SUSE CVE CVE-2018-16646 page https://www.suse.com/security/cve/CVE-2018-18897/ SUSE CVE CVE-2018-18897 page https://www.suse.com/security/cve/CVE-2018-19058/ SUSE CVE CVE-2018-19058 page https://www.suse.com/security/cve/CVE-2018-19059/ SUSE CVE CVE-2018-19059 page https://www.suse.com/security/cve/CVE-2018-19060/ SUSE CVE CVE-2018-19060 page https://www.suse.com/security/cve/CVE-2018-19149/ SUSE CVE CVE-2018-19149 page https://www.suse.com/security/cve/CVE-2018-20481/ SUSE CVE CVE-2018-20481 page https://www.suse.com/security/cve/CVE-2018-20650/ SUSE CVE CVE-2018-20650 page https://www.suse.com/security/cve/CVE-2018-21009/ SUSE CVE CVE-2018-21009 page https://www.suse.com/security/cve/CVE-2019-12293/ SUSE CVE CVE-2019-12293 page https://www.suse.com/security/cve/CVE-2019-7310/ SUSE CVE CVE-2019-7310 page https://www.suse.com/security/cve/CVE-2022-27337/ SUSE CVE CVE-2022-27337 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-cpp0-0.43.0-16.25.1 libpoppler-cpp0-32bit-0.43.0-16.25.1 libpoppler-cpp0-64bit-0.43.0-16.25.1 libpoppler-devel-0.43.0-16.25.1 libpoppler-glib-devel-0.43.0-16.25.1 libpoppler-glib8-0.43.0-16.25.1 libpoppler-glib8-32bit-0.43.0-16.25.1 libpoppler-glib8-64bit-0.43.0-16.25.1 libpoppler-qt4-4-0.43.0-16.25.1 libpoppler-qt4-4-32bit-0.43.0-16.25.1 libpoppler-qt4-4-64bit-0.43.0-16.25.1 libpoppler-qt4-devel-0.43.0-16.25.1 libpoppler-qt5-1-0.43.0-16.25.1 libpoppler-qt5-1-32bit-0.43.0-16.25.1 libpoppler-qt5-1-64bit-0.43.0-16.25.1 libpoppler-qt5-devel-0.43.0-16.25.1 libpoppler60-0.43.0-16.25.1 libpoppler60-32bit-0.43.0-16.25.1 libpoppler60-64bit-0.43.0-16.25.1 poppler-tools-0.43.0-16.25.1 typelib-1_0-Poppler-0_18-0.43.0-16.25.1 libpoppler-glib8-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpoppler-qt4-4-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpoppler60-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 poppler-tools-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpoppler-glib8-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpoppler-qt4-4-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpoppler60-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 poppler-tools-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpoppler-cpp0-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-devel-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-glib-devel-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-qt4-devel-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 typelib-1_0-Poppler-0_18-0.43.0-16.25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops. CVE-2017-18267 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2017-18267.html CVE-2017-18267 https://bugzilla.suse.com/1092945 SUSE Bug 1092945 Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file. CVE-2018-13988 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-13988.html CVE-2018-13988 https://bugzilla.suse.com/1102531 SUSE Bug 1102531 In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. CVE-2018-16646 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-16646.html CVE-2018-16646 https://bugzilla.suse.com/1107597 SUSE Bug 1107597 https://bugzilla.suse.com/1140882 SUSE Bug 1140882 An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo. CVE-2018-18897 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-18897.html CVE-2018-18897 https://bugzilla.suse.com/1114966 SUSE Bug 1114966 An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file. CVE-2018-19058 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-19058.html CVE-2018-19058 https://bugzilla.suse.com/1115187 SUSE Bug 1115187 An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts. CVE-2018-19059 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-19059.html CVE-2018-19059 https://bugzilla.suse.com/1115186 SUSE Bug 1115186 An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path. CVE-2018-19060 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-19060.html CVE-2018-19060 https://bugzilla.suse.com/1115185 SUSE Bug 1115185 Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment. CVE-2018-19149 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-19149.html CVE-2018-19149 https://bugzilla.suse.com/1115626 SUSE Bug 1115626 XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc. CVE-2018-20481 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-20481.html CVE-2018-20481 https://bugzilla.suse.com/1120495 SUSE Bug 1120495 A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach. CVE-2018-20650 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-20650.html CVE-2018-20650 https://bugzilla.suse.com/1120939 SUSE Bug 1120939 https://bugzilla.suse.com/1120956 SUSE Bug 1120956 Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. CVE-2018-21009 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2018-21009.html CVE-2018-21009 https://bugzilla.suse.com/1149635 SUSE Bug 1149635 In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. CVE-2019-12293 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2019-12293.html CVE-2019-12293 https://bugzilla.suse.com/1136105 SUSE Bug 1136105 In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. CVE-2019-7310 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2019-7310.html CVE-2019-7310 https://bugzilla.suse.com/1124150 SUSE Bug 1124150 A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. CVE-2022-27337 SUSE Linux Enterprise Server 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-glib8-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler-qt4-4-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpoppler60-0.43.0-16.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:poppler-tools-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-cpp0-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-glib-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler-qt4-devel-0.43.0-16.25.1 SUSE Linux Enterprise Software Development Kit 12 SP5:typelib-1_0-Poppler-0_18-0.43.0-16.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232907-1/ https://www.suse.com/security/cve/CVE-2022-27337.html CVE-2022-27337 https://bugzilla.suse.com/1199272 SUSE Bug 1199272