{"id":"CVE-2020-23804","aliases":["CLSA-2026-1787732795","DEBIAN-CVE-2020-23804","DLA-3620-1","EUVD-2020-16544","GHSA-cwfg-vhjr-jvv6","OESA-2023-1561","OESA-2023-1611","OESA-2023-1612","OESA-2023-1613","SUSE-SU-2023:3981-1","SUSE-SU-2023:3982-1","SUSE-SU-2023:3983-1","SUSE-SU-2023:3998-1","UBUNTU-CVE-2020-23804","USN-6508-1"],"status":"published","title":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause...","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01152,"percentile":0.67184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2023-08-22T00:00:00Z","modified":"2026-10-26T12:01:44Z","fixes":[{"ecosystem":"Debian:12","package":"poppler","fixed_in":["20.09.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["20.09.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["20.09.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","fixed_in":["0.41.0-0ubuntu1.16+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","fixed_in":["0.62.0-2ubuntu2.14+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"poppler","fixed_in":["0.86.1-0ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"gir1.2-poppler-0.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-cpp-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-cpp0v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-glib-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-glib8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-private-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-qt5-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler-qt5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libpoppler73","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-5+deb10u3"}]}],"versions":["0.71.0-5","0.71.0-5+deb10u1","0.71.0-5+deb10u2"],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-4.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-6.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-6.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-5.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-6.oe2203"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.4-14.36.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.35.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.35.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.35.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.35.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.35.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.35.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.25.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.25.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.25.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.25.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.16+esm4"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+esm2"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.4"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.16+esm4"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+esm2"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.4"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.3"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2"],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"freedesktop","product":"poppler"}],"references":[{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/issues/936","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00022.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-23804","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cwfg-vhjr-jvv6"},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787732795.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32365","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-23804","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38349","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1611","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1612","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1613","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233981-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214257","tags":["report"]},{"url":"https://bugzilla.suse.com/1214618","tags":["report"]},{"url":"https://bugzilla.suse.com/1214622","tags":["report"]},{"url":"https://bugzilla.suse.com/1215422","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-23804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38349","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233982-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37051","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233983-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233998-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-23804","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6508-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-23804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38349","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-23804","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-08-04T15:05:11.443Z","updated_at":"2026-11-02T14:35:49.209579Z"}],"euvd":[{"id":"EUVD-2020-16544","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-08-04T15:05:11Z","updated_at":"2026-11-03T03:07:21.209139Z"}],"ghsa":[{"id":"GHSA-cwfg-vhjr-jvv6","title":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause...","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T21:30:25Z","modified":"2023-12-08T21:30:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:55:09.695365Z"}],"nvd":[{"id":"CVE-2020-23804","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T19:16:19.52Z","modified":"2026-06-17T03:04:58.687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"CVE-2020-23804","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T19:16:19.52Z","modified":"2026-10-20T10:52:49.782854062Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"DEBIAN-CVE-2020-23804","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T19:16:19.52Z","modified":"2026-10-26T12:01:44.77116727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"OESA-2023-1561","title":"poppler security update","description":"poppler is a PDF rendering library.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-02T11:06:01Z","modified":"2026-08-18T01:17:48.674159359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1611","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-09T11:06:03Z","modified":"2026-08-18T01:17:00.222539099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1612","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-09T11:06:03Z","modified":"2026-08-18T01:17:53.648541734Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1613","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-09T11:06:03Z","modified":"2026-08-18T01:17:53.587967882Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2020-23804","description":"Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-04-22T12:34:01.340093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"CLSA-2026-1787732795","title":"Fix CVE(s): CVE-2020-23804, CVE-2025-32365","description":"   * SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine()\n     (JBIG2Stream.cc) via a crafted JBIG2 stream, from a misplaced isOk check\n     - debian/patches/CVE-2025-32365.patch: add the isOk() guard at the top of\n       JBIG2Bitmap::combine() so every caller is protected against\n       out-of-bounds reads on a not-OK bitmap (upstream commit 1f151565,\n       adapted to poppler 0.62 GBool/Guint)\n     - CVE-2025-32365\n   * SECURITY UPDATE: uncontrolled recursion / stack overflow in the XRefStm\n     chain parser (XRef.cc) via a crafted PDF, causing denial of service\n     - debian/patches/CVE-2020-23804.patch: cap the XRefStm chain at 4096\n       entries in XRef::readXRefTable() to stop the readXRef/readXRefTable\n       recursion from exhausting the stack on crafted PDFs (upstream commit\n       ec8a43c8)\n     - CVE-2020-23804","status":"published","published":"2026-08-26T08:26:47Z","modified":"2026-10-26T09:32:03.774012903Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3620-1","title":"poppler - security update","status":"published","published":"2023-10-16T00:00:00Z","modified":"2026-03-09T01:19:22.741368Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"SUSE-SU-2023:3981-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).\n- CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).\n- CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).\n- CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).\n","status":"published","published":"2023-10-05T11:48:38Z","modified":"2026-02-04T02:59:46.472156Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3982-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).\n- CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).\n- CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).\n- CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621).\n- CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).\n","status":"published","published":"2023-10-05T11:49:11Z","modified":"2026-02-04T04:17:57.977112Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3983-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).\n- CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).\n- CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).\n- CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621).\n- CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).\n","status":"published","published":"2023-10-05T11:49:50Z","modified":"2025-05-02T04:30:36.676978Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3998-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).\n- CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).\n- CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).\n- CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621).\n- CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).\n","status":"published","published":"2023-10-06T12:28:57Z","modified":"2026-02-04T03:57:14.067825Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6508-1","title":"poppler vulnerabilities","description":"It was discovered that poppler incorrectly handled certain malformed PDF\nfiles. If a user or an automated system were tricked into opening a\nspecially crafted PDF file, a remote attacker could possibly use this\nissue to cause a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)\n\nIt was discovered that poppler incorrectly handled certain malformed PDF\nfiles. If a user or an automated system were tricked into opening a\nspecially crafted PDF file, a remote attacker could possibly use this\nissue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,\nCVE-2022-37052, CVE-2022-38349)\n","status":"published","published":"2023-11-23T02:47:28Z","modified":"2026-06-25T13:31:28.978932701Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}