CVE-2022-37052

Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \ the PDF viewers of the open source GNOME and KDE desktop environments.

Security Fix(es):

Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)

An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)

An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)

Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \ the PDF viewers of the open source GNOME and KDE desktop environments.

Security Fix(es):

Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)

An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)

An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.

• CVE-2022-37050: fix reachable assertion in pdfseparate when PDF Catalog is not a dictionary (PDFDoc::savePageAs)
• CVE-2022-37051: fix reachable assertion in pdfunite when PDF Catalog is not a dictionary
• CVE-2022-37052: fix abort in pdfseparate caused by reachable assertion in XRef::add

• CVE-2022-37052: handle XRef::add failure in markObject to prevent reachable Object::getString assertion and denial of service in pdfseparate

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.

This update for poppler fixes the following issues:

• CVE-2019-9545: Fixed an uncontrolled recursion issue that could cause a crash (bsc#1128114).
• CVE-2022-37052: Fixed a crash that could be triggered when opening a crafted file (bsc#1214726).

This update for poppler fixes the following issues:

• CVE-2019-9545: Fixed a potential crash due to uncontrolled recursion in the JBIG parser (bsc#1128114).
• CVE-2019-9631: Fixed an out of bounds read when converting a PDF to an image (bsc#1129202).
• CVE-2022-37052: Fixed a reachable assertion when extracting pages of a PDf file (bsc#1214726).
• CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph (bsc#1214256).
• CVE-2019-13287: Fixed an out-of-bounds read vulnerability in the function SplashXPath:strokeAdjust (bsc#1140745).
• CVE-2018-18456: Fixed a stack-based buffer over-read via a crafted pdf file (bsc#1112428).
• CVE-2018-18454: Fixed heap-based buffer over-read via a crafted pdf file (bsc#1112424).
• CVE-2019-14292: Fixed an out of bounds read in GfxState.cc (bsc#1143570).
• CVE-2022-48545: Fixed an infinite recursion in Catalog::findDestInTree which can cause denial of service (bsc#1214723).

This update for poppler fixes the following issues:

• CVE-2022-37052: Fixed a crash that could be triggered when opening a crafted file (bsc#1214726).
• CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc (bsc#1213888).

This update for poppler fixes the following issues:

• CVE-2019-9545: Fixed a potential crash due to uncontrolled recursion in the JBIG parser (bsc#1128114).
• CVE-2019-9631: Fixed an out of bounds read when converting a PDF to an image (bsc#1129202).
• CVE-2022-37052: Fixed a reachable assertion when extracting pages of a PDf file (bsc#1214726).
• CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph (bsc#1214256).
• CVE-2019-14292: Fixed an out of bounds read in GfxState.cc (bsc#1143570).
• CVE-2022-48545: Fixed an infinite recursion in Catalog::findDestInTree which can cause denial of service (bsc#1214723).

This update for poppler fixes the following issues:

• CVE-2019-9545: Fixed an uncontrolled recursion issue that could cause a crash (bsc#1128114).
• CVE-2022-37052: Fixed a crash that could be triggered when opening a crafted file (bsc#1214726).
• CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph (bsc#1214256).

It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or an automated system were tricked into opening a specially crafted PDF file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)

It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or an automated system were tricked into opening a specially crafted PDF file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051, CVE-2022-37052, CVE-2022-38349)