CVE-2023-34872
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a...
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
CVE-2023-34872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
CVE-2023-34872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-38912
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
EUVD-2023-38912- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-77j7-vm29-rwwv
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a...
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
GHSA-77j7-vm29-rwwv- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVBELL-CVE-2023-34872
- Record
BELL-CVE-2023-34872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
CVE-2023-34872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2023-34872
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
DEBIAN-CVE-2023-34872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-82
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
JLSEC-2026-82- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-34872
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
- Record
UBUNTU-CVE-2023-34872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0348 No score
Updated poppler packages fix a security vulnerability
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open. (CVE-2023-34872) This update fixes that issue.
- Record
MGASA-2023-0348- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-318-CVE-2023-34872 No score
CVE-2023-34872 in poppler - Patched by Root
Root has patched CVE-2023-34872 in the poppler package for Root:Alpine:3.18. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-318-CVE-2023-34872- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2023-34872 No score
CVE-2023-34872 in rootio-poppler - Patched by Root
Root has patched CVE-2023-34872 in the rootio-poppler package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2023-34872- Updated
- 2026-11-02
OSVSUSE-SU-2023:4291-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc. (bsc#1213888)
- Record
SUSE-SU-2023:4291-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4363-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2022-37052: Fixed a crash that could be triggered when opening a crafted file (bsc#1214726).
- CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc (bsc#1213888).
- Record
SUSE-SU-2023:4363-1- Updated
- 2026-11-02
OSVUSN-6273-1 No score
poppler vulnerabilities
Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27337)
It was discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-34872)
- Record
USN-6273-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerAlpaquita:23 |
22.11.0-r0 up to 22.11.0-r1 | 22.11.0-r1 |
popplerDebian:12 |
before 22.12.0-2+deb12u1, plus listed versions 22.12.0-2 |
22.12.0-2+deb12u1 |
popplerDebian:13 |
before 24.02.0-2 | 24.02.0-2 |
popplerDebian:14 |
before 24.02.0-2 | 24.02.0-2 |
Poppler_jllJulia |
before 23.12.0+0 | 23.12.0+0 |
popplerMageia:9 |
before 23.02.0-1.1.mga9 | 23.02.0-1.1.mga9 |
popplerRoot:Alpine:3.18 |
before 23.05.0-r00071 | 23.05.0-r0007123.05.0-r0007223.05.0-r0007323.05.0-r0007423.05.0-r00075 |
rootio-popplerRoot:Alpine:3.18 |
before 23.05.0-r00071 | 23.05.0-r0007123.05.0-r0007223.05.0-r0007323.05.0-r0007423.05.0-r00075 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 23.01.0-150500.3.5.2 | 23.01.0-150500.3.5.2 |
popplerSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 23.01.0-150500.3.5.2 | 23.01.0-150500.3.5.2 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-qt5SUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 23.01.0-150500.3.5.1 | 23.01.0-150500.3.5.1 |
poppleropenSUSE:Leap 15.5 |
before 23.01.0-150500.3.5.2 | 23.01.0-150500.3.5.2 |
poppler-qt5openSUSE:Leap 15.5 |
before 23.01.0-150500.3.5.1 | 23.01.0-150500.3.5.1 |
poppler-qt6openSUSE:Leap 15.5 |
before 23.01.0-150500.3.5.1 | 23.01.0-150500.3.5.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
popplerSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
poppler-qt5SUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
popplerSUSE:Linux Enterprise Workstation Extension 15 SP5 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
poppleropenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
poppler-qt5openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
poppler-qt6openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 22.01.0-150400.3.16.1 | 22.01.0-150400.3.16.1 |
popplerUbuntu:22.04:LTS |
before 22.02.0-2ubuntu0.2, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.1 |
22.02.0-2ubuntu0.2 |
popplerUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 0.86.1-0ubuntu1.2, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu10.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.1 |
0.86.1-0ubuntu1.2 |
popplerUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 22.02.0-2ubuntu0.2, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.1 |
22.02.0-2ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34872 is a medium vulnerability (CVSS 5.5) in Freedesktop Poppler, published July 31, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in poppler 22.11.0-r1.
References
gitlab.freedesktop.org/poppler/poppler/-/commit/591235c8b6c65a2eee88991b9ae73490fd9afdfe
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFBT75QHBWNMSDAHSXZQ2I3PBJWID36K
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-34872
github.com/advisories/GHSA-77j7-vm29-rwwv
docs.bell-sw.com/security/cves/CVE-2023-34872
security-tracker.debian.org/tracker/CVE-2023-34872
advisories.mageia.org/MGASA-2023-0348.html
bugs.mageia.org/show_bug.cgi?id=32600
bugzilla.redhat.com/show_bug.cgi?id=2227884
suse.com/support/update/announcement/2023/suse-su-20234291-1
bugzilla.suse.com/1213888
ubuntu.com/security/CVE-2023-34872
cve.org/CVERecord?id=CVE-2023-34872