{"id":"CVE-2022-37052","aliases":["CLSA-2026-1781191047","CLSA-2026-1781207304","DEBIAN-CVE-2022-37052","DLA-4141-1","EUVD-2022-39706","GHSA-527m-pccf-wf58","OESA-2023-1561","OESA-2023-1611","OESA-2023-1612","OESA-2023-1613","SUSE-SU-2023:4270-1","SUSE-SU-2023:4362-1","SUSE-SU-2023:4363-1","SUSE-SU-2023:4546-1","SUSE-SU-2023:4562-1","UBUNTU-CVE-2022-37052","USN-6508-1"],"status":"published","title":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of...","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01063,"percentile":0.64857,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2023-08-22T00:00:00Z","modified":"2026-11-03T06:02:42Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp-devel","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-devel","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-devel","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-doc","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5-devel","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-utils","fixed_in":["21.01.0-21.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"poppler","fixed_in":["22.08.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["22.08.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["22.08.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","fixed_in":["0.41.0-0ubuntu1.16+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","fixed_in":["0.62.0-2ubuntu2.14+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"poppler","fixed_in":["0.86.1-0ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"poppler","fixed_in":["22.02.0-2ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.08.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.08.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.08.0-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09.0-3.1+deb11u2"}]}],"versions":["20.09.0-3.1","20.09.0-3.1+deb11u1"],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-4.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-6.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-6.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-5.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-6.oe2203"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-150000.4.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.40.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.4-14.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.16+esm4"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+esm2"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.4"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.3"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.16+esm4"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+esm2"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.4"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.3"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2"],"bundled":5}],"products":[{"vendor":"freedesktop","product":"poppler"}],"references":[{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/issues/1278","tags":["x_transferred","Exploit","Issue Tracking","report"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/8677500399fc2548fa816b619580c2c07915a98c","tags":["x_transferred","Patch","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37052","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-527m-pccf-wf58"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781191047.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37051","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781207304.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37052.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37052","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-23804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38349","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1611","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1612","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1613","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234270-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128114","tags":["report"]},{"url":"https://bugzilla.suse.com/1214726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37052","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234362-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1112424","tags":["report"]},{"url":"https://bugzilla.suse.com/1112428","tags":["report"]},{"url":"https://bugzilla.suse.com/1129202","tags":["report"]},{"url":"https://bugzilla.suse.com/1140745","tags":["report"]},{"url":"https://bugzilla.suse.com/1143570","tags":["report"]},{"url":"https://bugzilla.suse.com/1214256","tags":["report"]},{"url":"https://bugzilla.suse.com/1214723","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48545","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34872","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234546-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234562-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-37052","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6508-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-23804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38349","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-37052","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2025-11-03T19:27:20.326Z","updated_at":"2026-11-02T14:34:27.327929Z"}],"euvd":[{"id":"EUVD-2022-39706","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2025-11-03T19:27:20Z","updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-527m-pccf-wf58","title":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of...","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T21:30:26Z","modified":"2025-11-03T21:30:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:04:18.176646Z"}],"nvd":[{"id":"CVE-2022-37052","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T19:16:23.8Z","modified":"2026-06-17T04:54:32.023Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:07:39.811118Z"}],"osv":[{"id":"OESA-2023-1561","title":"poppler security update","description":"poppler is a PDF rendering library.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-02T11:06:01Z","modified":"2026-08-18T01:17:48.674159359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1611","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-09T11:06:03Z","modified":"2026-08-18T01:17:00.222539099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1612","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-09T11:06:03Z","modified":"2026-08-18T01:17:53.648541734Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1613","title":"poppler security update","description":"Poppler is a free software utility library for rendering Portable Document Format (PDF) documents. \\ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \\ the PDF viewers of the open source GNOME and KDE desktop environments.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.(CVE-2020-23804)\r\n\r\nIn Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.(CVE-2022-37050)\r\n\r\nAn issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.(CVE-2022-37051)\r\n\r\nA reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.(CVE-2022-37052)\r\n\r\nAn issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.(CVE-2022-38349)","status":"published","published":"2023-09-09T11:06:03Z","modified":"2026-08-18T01:17:53.587967882Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2022-37052","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-04-22T13:28:17.525579Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CLSA-2026-1781191047","title":"poppler: Fix of 3 CVEs","description":"- CVE-2022-37050: fix reachable assertion in pdfseparate when PDF Catalog is not\n  a dictionary (PDFDoc::savePageAs)\n- CVE-2022-37051: fix reachable assertion in pdfunite when PDF Catalog is not\n  a dictionary\n- CVE-2022-37052: fix abort in pdfseparate caused by reachable assertion in XRef::add","status":"published","published":"2026-06-11T15:17:47Z","modified":"2026-10-26T09:30:19.88583831Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781207304","title":"poppler: Fix of CVE-2022-37052","description":"- CVE-2022-37052: handle XRef::add failure in markObject to prevent\n  reachable Object::getString assertion and denial of service in pdfseparate","status":"published","published":"2026-06-11T19:48:39Z","modified":"2026-10-26T09:31:10.718049319Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CVE-2022-37052","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2026-10-28T10:27:27.227500602Z","updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-37052","description":"A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.","status":"published","published":"2023-08-22T19:16:23.8Z","modified":"2026-11-03T06:02:42.981375971Z","updated_at":"2026-11-03T06:43:43.638289Z"},{"id":"DLA-4141-1","title":"poppler - security update","status":"published","published":"2025-04-28T00:00:00Z","modified":"2026-03-09T01:18:13.180725Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"SUSE-SU-2023:4270-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2019-9545: Fixed an uncontrolled recursion issue that could\n  cause a crash (bsc#1128114).\n- CVE-2022-37052: Fixed a crash that could be triggered when opening\n  a crafted file (bsc#1214726).\n","status":"published","published":"2023-10-30T16:50:51Z","modified":"2026-02-04T02:21:42.219246Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4362-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2019-9545: Fixed a potential crash due to uncontrolled recursion\n  in the JBIG parser (bsc#1128114).\n- CVE-2019-9631: Fixed an out of bounds read when converting a PDF to\n  an image (bsc#1129202).\n- CVE-2022-37052: Fixed a reachable assertion when extracting pages of\n  a PDf file (bsc#1214726).\n- CVE-2020-36023: Fixed a stack bugger overflow in\n  FoFiType1C:cvtGlyph (bsc#1214256).\n- CVE-2019-13287: Fixed an out-of-bounds read vulnerability in the\n  function SplashXPath:strokeAdjust (bsc#1140745).\n- CVE-2018-18456: Fixed a stack-based buffer over-read via a crafted\n  pdf file (bsc#1112428).\n- CVE-2018-18454: Fixed heap-based buffer over-read via a crafted pdf\n  file (bsc#1112424).\n- CVE-2019-14292: Fixed an out of bounds read in GfxState.cc\n  (bsc#1143570).\n- CVE-2022-48545: Fixed an infinite recursion in\n  Catalog::findDestInTree which can cause denial of service\n  (bsc#1214723).\n","status":"published","published":"2023-11-03T12:48:58Z","modified":"2026-02-04T02:19:12.409862Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4363-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2022-37052: Fixed a crash that could be triggered when opening\n  a crafted file (bsc#1214726).\n- CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc\n  (bsc#1213888).\n","status":"published","published":"2023-11-03T12:49:27Z","modified":"2026-02-04T03:10:23.662285Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4546-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2019-9545: Fixed a potential crash due to uncontrolled recursion\n  in the JBIG parser (bsc#1128114).\n- CVE-2019-9631: Fixed an out of bounds read when converting a PDF to\n  an image (bsc#1129202).\n- CVE-2022-37052: Fixed a reachable assertion when extracting pages of\n  a PDf file (bsc#1214726).\n- CVE-2020-36023: Fixed a stack bugger overflow in\n  FoFiType1C:cvtGlyph (bsc#1214256).\n- CVE-2019-14292: Fixed an out of bounds read in GfxState.cc\n  (bsc#1143570).\n- CVE-2022-48545: Fixed an infinite recursion in\n  Catalog::findDestInTree which can cause denial of service\n  (bsc#1214723).\n","status":"published","published":"2023-11-24T08:11:55Z","modified":"2026-02-04T04:29:29.114918Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4562-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2019-9545: Fixed an uncontrolled recursion issue that could\n  cause a crash (bsc#1128114).\n- CVE-2022-37052: Fixed a crash that could be triggered when opening\n  a crafted file (bsc#1214726).\n- CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph (bsc#1214256).\n","status":"published","published":"2023-11-24T16:12:20Z","modified":"2026-02-04T04:00:42.397586Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6508-1","title":"poppler vulnerabilities","description":"It was discovered that poppler incorrectly handled certain malformed PDF\nfiles. If a user or an automated system were tricked into opening a\nspecially crafted PDF file, a remote attacker could possibly use this\nissue to cause a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)\n\nIt was discovered that poppler incorrectly handled certain malformed PDF\nfiles. If a user or an automated system were tricked into opening a\nspecially crafted PDF file, a remote attacker could possibly use this\nissue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,\nCVE-2022-37052, CVE-2022-38349)\n","status":"published","published":"2023-11-23T02:47:28Z","modified":"2026-06-25T13:31:28.978932701Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}