Security update for poppler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3983-1 Final 1 1 2023-10-05T11:49:50Z current 2023-10-05T11:49:50Z 2023-10-05T11:49:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for poppler This update for poppler fixes the following issues: - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422). - CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257). - CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622). - CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621). - CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3983,SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3983,SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3983,SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3983,openSUSE-SLE-15.4-2023-3983 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/ Link for SUSE-SU-2023:3983-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016547.html E-Mail link for SUSE-SU-2023:3983-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214257 SUSE Bug 1214257 https://bugzilla.suse.com/1214618 SUSE Bug 1214618 https://bugzilla.suse.com/1214621 SUSE Bug 1214621 https://bugzilla.suse.com/1214622 SUSE Bug 1214622 https://bugzilla.suse.com/1215422 SUSE Bug 1215422 https://www.suse.com/security/cve/CVE-2020-23804/ SUSE CVE CVE-2020-23804 page https://www.suse.com/security/cve/CVE-2020-36024/ SUSE CVE CVE-2020-36024 page https://www.suse.com/security/cve/CVE-2022-37050/ SUSE CVE CVE-2022-37050 page https://www.suse.com/security/cve/CVE-2022-37051/ SUSE CVE CVE-2022-37051 page https://www.suse.com/security/cve/CVE-2022-38349/ SUSE CVE CVE-2022-38349 page SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 openSUSE Leap 15.4 libpoppler-cpp0-0.62.0-150000.4.25.2 libpoppler-cpp0-32bit-0.62.0-150000.4.25.2 libpoppler-cpp0-64bit-0.62.0-150000.4.25.2 libpoppler-devel-0.62.0-150000.4.25.2 libpoppler-glib-devel-0.62.0-150000.4.25.2 libpoppler-glib8-0.62.0-150000.4.25.2 libpoppler-glib8-32bit-0.62.0-150000.4.25.2 libpoppler-glib8-64bit-0.62.0-150000.4.25.2 libpoppler-qt5-1-0.62.0-150000.4.25.2 libpoppler-qt5-1-32bit-0.62.0-150000.4.25.2 libpoppler-qt5-1-64bit-0.62.0-150000.4.25.2 libpoppler-qt5-devel-0.62.0-150000.4.25.2 libpoppler73-0.62.0-150000.4.25.2 libpoppler73-32bit-0.62.0-150000.4.25.2 libpoppler73-64bit-0.62.0-150000.4.25.2 poppler-tools-0.62.0-150000.4.25.2 typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 libpoppler-cpp0-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libpoppler-devel-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libpoppler-glib-devel-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libpoppler-glib8-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libpoppler73-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS poppler-tools-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libpoppler-cpp0-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libpoppler-devel-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libpoppler-glib-devel-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libpoppler-glib8-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libpoppler73-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS poppler-tools-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libpoppler-cpp0-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libpoppler-devel-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libpoppler-glib-devel-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libpoppler-glib8-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libpoppler73-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 poppler-tools-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libpoppler73-0.62.0-150000.4.25.2 as a component of openSUSE Leap 15.4 libpoppler73-32bit-0.62.0-150000.4.25.2 as a component of openSUSE Leap 15.4 Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. CVE-2020-23804 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-32bit-0.62.0-150000.4.25.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/ https://www.suse.com/security/cve/CVE-2020-23804.html CVE-2020-23804 https://bugzilla.suse.com/1215422 SUSE Bug 1215422 An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. CVE-2020-36024 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-32bit-0.62.0-150000.4.25.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/ https://www.suse.com/security/cve/CVE-2020-36024.html CVE-2020-36024 https://bugzilla.suse.com/1214257 SUSE Bug 1214257 In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. CVE-2022-37050 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-32bit-0.62.0-150000.4.25.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/ https://www.suse.com/security/cve/CVE-2022-37050.html CVE-2022-37050 https://bugzilla.suse.com/1214622 SUSE Bug 1214622 An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file. CVE-2022-37051 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-32bit-0.62.0-150000.4.25.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/ https://www.suse.com/security/cve/CVE-2022-37051.html CVE-2022-37051 https://bugzilla.suse.com/1214621 SUSE Bug 1214621 An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. CVE-2022-38349 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server 15 SP1-LTSS:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-cpp0-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib-devel-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler-glib8-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libpoppler73-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:poppler-tools-0.62.0-150000.4.25.2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:typelib-1_0-Poppler-0_18-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-0.62.0-150000.4.25.2 openSUSE Leap 15.4:libpoppler73-32bit-0.62.0-150000.4.25.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/ https://www.suse.com/security/cve/CVE-2022-38349.html CVE-2022-38349 https://bugzilla.suse.com/1214618 SUSE Bug 1214618