{"id":"CVE-2023-34872","aliases":["BELL-CVE-2023-34872","DEBIAN-CVE-2023-34872","EUVD-2023-38912","GHSA-77j7-vm29-rwwv","JLSEC-2026-82","MGASA-2023-0348","ROOT-OS-ALPINE-318-CVE-2023-34872","ROOT-OS-DEBIAN-12-CVE-2023-34872","SUSE-SU-2023:4291-1","SUSE-SU-2023:4363-1","UBUNTU-CVE-2023-34872","USN-6273-1"],"status":"published","title":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a...","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00912,"percentile":0.60274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-07-31T00:00:00Z","modified":"2026-10-28T10:31:35Z","fixes":[{"ecosystem":"Alpaquita:23","package":"poppler","fixed_in":["22.11.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"poppler","fixed_in":["22.12.0-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["24.02.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["24.02.0-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"Poppler_jll","fixed_in":["23.12.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"poppler","fixed_in":["23.02.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"poppler","fixed_in":["23.05.0-r00071","23.05.0-r00072","23.05.0-r00073","23.05.0-r00074","23.05.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-poppler","fixed_in":["23.05.0-r00071","23.05.0-r00072","23.05.0-r00073","23.05.0-r00074","23.05.0-r00075"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"poppler","fixed_in":["23.01.0-150500.3.5.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"poppler","fixed_in":["23.01.0-150500.3.5.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"poppler-qt5","fixed_in":["23.01.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"poppler","fixed_in":["23.01.0-150500.3.5.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"poppler-qt5","fixed_in":["23.01.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"poppler-qt6","fixed_in":["23.01.0-150500.3.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"poppler","fixed_in":["22.02.0-2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.11.0-r0"},{"fixed":"22.11.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.12.0-2+deb12u1"}]}],"versions":["22.12.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-2"}]}]},{"source":"osv","ecosystem":"Julia","package":"Poppler_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"23.12.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.05.0-r00071"},{"fixed":"23.05.0-r00072"},{"fixed":"23.05.0-r00073"},{"fixed":"23.05.0-r00074"},{"fixed":"23.05.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.05.0-r00071"},{"fixed":"23.05.0-r00072"},{"fixed":"23.05.0-r00073"},{"fixed":"23.05.0-r00074"},{"fixed":"23.05.0-r00075"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.5.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.5.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.5.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.2"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.2"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.2"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1"],"bundled":2}],"products":[{"vendor":"freedesktop","product":"poppler"}],"references":[{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/591235c8b6c65a2eee88991b9ae73490fd9afdfe","tags":["x_transferred","Patch","fix","web"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/issues/1399","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFBT75QHBWNMSDAHSXZQ2I3PBJWID36K/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3H3GOWFE3C7543GMEN7LY4GWMWJ7D2G/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XXL3L6RJOTLGCN7GLH2OLLNF4FJ4T7I/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ3NYJ43U2MA7COKGMJDARZUAAOP45D4/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3XXL3L6RJOTLGCN7GLH2OLLNF4FJ4T7I/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ3NYJ43U2MA7COKGMJDARZUAAOP45D4/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34872","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XXL3L6RJOTLGCN7GLH2OLLNF4FJ4T7I"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ3NYJ43U2MA7COKGMJDARZUAAOP45D4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFBT75QHBWNMSDAHSXZQ2I3PBJWID36K"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3H3GOWFE3C7543GMEN7LY4GWMWJ7D2G"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3XXL3L6RJOTLGCN7GLH2OLLNF4FJ4T7I"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ3NYJ43U2MA7COKGMJDARZUAAOP45D4"},{"url":"https://github.com/advisories/GHSA-77j7-vm29-rwwv"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-34872","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34872.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-34872","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0348.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32600","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227884","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234291-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34872","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37052","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-34872","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6273-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-34872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27337","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-34872","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-07-31T00:00:00Z","modified":"2025-11-04T19:16:50.776Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:35.580545Z"}],"euvd":[{"id":"EUVD-2023-38912","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-07-31T00:00:00Z","modified":"2025-11-04T19:16:50Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:22.434386Z"}],"ghsa":[{"id":"GHSA-77j7-vm29-rwwv","title":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a...","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-07-31T15:30:25Z","modified":"2025-11-04T21:30:38Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:04:35.540979Z"}],"nvd":[{"id":"CVE-2023-34872","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-07-31T14:15:10.427Z","modified":"2026-06-17T06:04:05.73Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:18.687088Z"}],"osv":[{"id":"BELL-CVE-2023-34872","status":"published","published":"2023-10-18T13:44:49.645947Z","modified":"2026-01-26T09:33:23.928625Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-34872","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-07-31T00:00:00Z","modified":"2026-10-28T10:31:35.542791504Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"DEBIAN-CVE-2023-34872","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-07-31T14:15:10.427Z","modified":"2026-10-26T18:02:19.609745814Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"JLSEC-2026-82","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2026-04-13T13:20:05.063Z","modified":"2026-07-18T00:02:23.969234025Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"UBUNTU-CVE-2023-34872","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.","status":"published","published":"2023-08-01T00:00:00Z","modified":"2026-04-22T14:08:44.121818Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"MGASA-2023-0348","title":"Updated poppler packages fix a security vulnerability","description":"A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a\nremote attacker to cause a Denial of Service (DoS) (crash) via a crafted\nPDF file in OutlineItem::open. (CVE-2023-34872)\nThis update fixes that issue.\n","status":"published","published":"2023-12-16T21:14:19Z","modified":"2026-04-16T04:41:12.247159286Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2023-34872","title":"CVE-2023-34872 in poppler - Patched by Root","description":"Root has patched CVE-2023-34872 in the poppler package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:26:29Z","modified":"2026-09-29T11:15:02.831103021Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-34872","title":"CVE-2023-34872 in rootio-poppler - Patched by Root","description":"Root has patched CVE-2023-34872 in the rootio-poppler package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-08-26T02:10:22.985342584Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2023:4291-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc. (bsc#1213888)\n","status":"published","published":"2023-10-31T08:19:00Z","modified":"2026-02-04T04:20:28.074334Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4363-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2022-37052: Fixed a crash that could be triggered when opening\n  a crafted file (bsc#1214726).\n- CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc\n  (bsc#1213888).\n","status":"published","published":"2023-11-03T12:49:27Z","modified":"2026-02-04T03:10:23.662285Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6273-1","title":"poppler vulnerabilities","description":"Jieyong Ma discovered that poppler incorrectly handled certain malformed\nPDF files. A remote attacker could possibly use this issue to cause poppler\nto crash, resulting in a denial of service. This issue only affected Ubuntu\n20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27337)\n\nIt was discovered that poppler incorrectly handled certain malformed PDF\nfiles. A remote attacker could possibly use this issue to cause poppler to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 23.04. (CVE-2023-34872)\n","status":"published","published":"2023-08-03T13:39:24Z","modified":"2026-04-22T10:37:33.465783Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}