Security update for poppler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3981-1 Final 1 1 2023-10-05T11:48:38Z current 2023-10-05T11:48:38Z 2023-10-05T11:48:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for poppler This update for poppler fixes the following issues: - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422). - CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257). - CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622). - CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3981,SUSE-SLE-SDK-12-SP5-2023-3981 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233981-1/ Link for SUSE-SU-2023:3981-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016549.html E-Mail link for SUSE-SU-2023:3981-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214257 SUSE Bug 1214257 https://bugzilla.suse.com/1214618 SUSE Bug 1214618 https://bugzilla.suse.com/1214622 SUSE Bug 1214622 https://bugzilla.suse.com/1215422 SUSE Bug 1215422 https://www.suse.com/security/cve/CVE-2020-23804/ SUSE CVE CVE-2020-23804 page https://www.suse.com/security/cve/CVE-2020-36024/ SUSE CVE CVE-2020-36024 page https://www.suse.com/security/cve/CVE-2022-37050/ SUSE CVE CVE-2022-37050 page https://www.suse.com/security/cve/CVE-2022-38349/ SUSE CVE CVE-2022-38349 page SUSE Linux Enterprise Software Development Kit 12 SP5 libpoppler-cpp0-0.24.4-14.36.2 libpoppler-devel-0.24.4-14.36.2 libpoppler-glib-devel-0.24.4-14.36.2 libpoppler-glib8-0.24.4-14.36.2 libpoppler-qt4-4-0.24.4-14.36.2 libpoppler-qt4-devel-0.24.4-14.36.2 libpoppler44-0.24.4-14.36.2 poppler-tools-0.24.4-14.36.2 typelib-1_0-Poppler-0_18-0.24.4-14.36.2 libpoppler44-0.24.4-14.36.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. CVE-2020-23804 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler44-0.24.4-14.36.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233981-1/ https://www.suse.com/security/cve/CVE-2020-23804.html CVE-2020-23804 https://bugzilla.suse.com/1215422 SUSE Bug 1215422 An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. CVE-2020-36024 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler44-0.24.4-14.36.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233981-1/ https://www.suse.com/security/cve/CVE-2020-36024.html CVE-2020-36024 https://bugzilla.suse.com/1214257 SUSE Bug 1214257 In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. CVE-2022-37050 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler44-0.24.4-14.36.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233981-1/ https://www.suse.com/security/cve/CVE-2022-37050.html CVE-2022-37050 https://bugzilla.suse.com/1214622 SUSE Bug 1214622 An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. CVE-2022-38349 SUSE Linux Enterprise Software Development Kit 12 SP5:libpoppler44-0.24.4-14.36.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233981-1/ https://www.suse.com/security/cve/CVE-2022-38349.html CVE-2022-38349 https://bugzilla.suse.com/1214618 SUSE Bug 1214618