{"id":"CVE-2025-53367","aliases":["DEBIAN-CVE-2025-53367","DLA-4247-1","DSA-5960-1","EUVD-2025-19908","MGASA-2025-0209","OESA-2025-1756","SUSE-SU-2025:02695-1","SUSE-SU-2025:02703-1","UBUNTU-CVE-2025-53367","USN-7631-1","openSUSE-SU-2025:15319-1"],"status":"published","title":"DjVuLibre OOB-Write Vulnerability in MMRDecoder","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0087,"percentile":0.59073,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2025-07-03T21:07:49Z","modified":"2026-09-01T20:05:53Z","exploits":[{"source":"pocgithub","id":"kevinbackhouse/DjVuLibre-poc-CVE-2025-53367","title":"kevinbackhouse/DjVuLibre-poc-CVE-2025-53367","date":"2025-07-18","url":"https://github.com/kevinbackhouse/DjVuLibre-poc-CVE-2025-53367"},{"source":"pocgithub","id":"ThePhykon/CVE-2025-53367-POC","title":"ThePhykon/CVE-2025-53367-POC","date":"2025-11-17","url":"https://github.com/ThePhykon/CVE-2025-53367-POC"}],"fixes":[{"ecosystem":"Debian:12","package":"djvulibre","fixed_in":["3.5.28-2.1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"djvulibre","fixed_in":["3.5.28-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"djvulibre","fixed_in":["3.5.28-2.1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"djvulibre","fixed_in":["3.5.29-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"djvulibre","fixed_in":["3.5.27-20.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"djvulibre","fixed_in":["3.5.28-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"djvulibre","fixed_in":["3.5.28-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"djvulibre","fixed_in":["3.5.28-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"djvulibre","fixed_in":["3.5.27-21.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"djvulibre","fixed_in":["3.5.27-20.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"djvulibre","fixed_in":["3.5.25.3-5.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"djvulibre","fixed_in":["3.5.27-150200.11.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"djvulibre","fixed_in":["3.5.27-150200.11.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"djvulibre","fixed_in":["3.5.27-150200.11.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"djvulibre","fixed_in":["3.5.27-150200.11.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"djvulibre","fixed_in":["3.5.27-150200.11.17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"djvulibre","fixed_in":["3.5.27.1-5ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"djvulibre","fixed_in":["3.5.27.1-8ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"djvulibre","fixed_in":["3.5.27.1-14ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"djvulibre","fixed_in":["3.5.28-2ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"djvulibre","fixed_in":["3.5.28-2ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"djvulibre","fixed_in":["3.5.29-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.1~deb12u1"}]}],"versions":["3.5.28-2"]},{"source":"osv","ecosystem":"Debian:13","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.2~deb11u1"}]}],"versions":["3.5.28-2","3.5.28-2.1","3.5.28-2.1~deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.1~deb12u1"}]}],"versions":["3.5.28-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.29-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-20.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-21.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-20.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.25.3-5.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-150200.11.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-150200.11.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-150200.11.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-150200.11.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-150200.11.17.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27.1-5ubuntu0.1+esm3"}]}],"versions":["3.5.27.1-3","3.5.27.1-4","3.5.27.1-5","3.5.27.1-5ubuntu0.1","3.5.27.1-5ubuntu0.1+esm1","3.5.27.1-5ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27.1-8ubuntu0.4+esm1"}]}],"versions":["3.5.27.1-7","3.5.27.1-8","3.5.27.1-8ubuntu0.1","3.5.27.1-8ubuntu0.2","3.5.27.1-8ubuntu0.3","3.5.27.1-8ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27.1-14ubuntu0.1+esm1"}]}],"versions":["3.5.27.1-13","3.5.27.1-13ubuntu1","3.5.27.1-14","3.5.27.1-14build1","3.5.27.1-14ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2ubuntu0.22.04.1"}]}],"versions":["3.5.28-2build1","3.5.28-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2ubuntu0.24.04.1"}]}],"versions":["3.5.28-2build3","3.5.28-2build4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2ubuntu0.22.04.1"}]}],"versions":["3.5.28-2build1","3.5.28-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.28-2ubuntu0.24.04.1"}]}],"versions":["3.5.28-2build3","3.5.28-2build4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"djvulibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.29-1.1"}]}]}],"products":[{"vendor":"djvunet","product":"djvulibre"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2025-055_DjVuLibre/","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre","tags":["x_refsource_MISC","article","report"]},{"url":"https://github.com/github/securitylab/tree/main/SecurityExploits/DjVuLibre/MMRDecoder_scanruns_CVE-2025-53367","tags":["x_refsource_MISC","web"]},{"url":"https://sourceforge.net/p/djvu/djvulibre-git/ci/33f645196593d70bd5e37f55b63886c31c82c3da","tags":["x_refsource_MISC","web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/03/1","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/","tags":["exploit","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00007.html"},{"url":"http://www.openwall.com/lists/oss-security/2025/07/03/1"},{"url":"http://www.openwall.com/lists/oss-security/2025/07/18/3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-53367","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0209.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34423","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7631-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53367","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502695-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245773","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53367","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502703-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-53367","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53367","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8054-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-53367","title":"DjVuLibre OOB-Write Vulnerability in MMRDecoder","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","status":"published","published":"2025-07-03T21:07:49.075Z","modified":"2025-11-04T21:11:47.6Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-787","CWE-125"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-19908","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","status":"published","published":"2025-07-03T21:07:49Z","modified":"2025-11-04T21:11:47Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"nvd":[{"id":"CVE-2025-53367","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","status":"published","published":"2025-07-03T21:15:27.493Z","modified":"2026-06-17T09:38:06.16Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:11:15.754475Z"}],"osv":[{"id":"CVE-2025-53367","title":"DjVuLibre OOB-Write Vulnerability in MMRDecoder","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","status":"published","published":"2025-07-03T21:07:49Z","modified":"2026-04-16T04:37:10.126840618Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"DEBIAN-CVE-2025-53367","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","status":"published","published":"2025-07-03T21:15:27.493Z","modified":"2026-09-01T20:05:53.77162196Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-1756","title":"djvulibre security update","description":"DjVu is a set of compression technologies, a file format, and a software platform for the deliveryover the Web of digital documents, scanned documents, and high resolution images.DjVu documents download and display extremely quickly, and look exactly the same on all platforms with no compatibility problems due to fonts, colors, etc. DjVu can be seen as a superior alternative to PDF and PostScript for digital documents, to TIFF (and PDF) for scanned bitonal documents, to JPEG and JPEG2000 for photographs and pictures, and to GIF for large palettized images. DjVu is the only Web format that is practical for distributing high-resolution scanned documents in color.\r\n\r\nSecurity Fix(es):\n\nDjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.(CVE-2025-53367)","status":"published","published":"2025-07-11T11:08:50Z","modified":"2026-08-18T01:18:52.011301896Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"UBUNTU-CVE-2025-53367","description":"DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.","status":"published","published":"2025-07-04T00:00:00Z","modified":"2026-04-22T16:05:39.854102Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"DLA-4247-1","title":"djvulibre - security update","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-03-09T02:09:01.207403Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5960-1","title":"djvulibre - security update","status":"published","published":"2025-07-07T00:00:00Z","modified":"2026-03-09T02:11:15.777068Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0209","title":"Updated djvulibre packages fix security vulnerability","description":"An out-of-bounds write in the MMRDecoder::scanruns method was fixed.\nThe vulnerability could be exploited to gain code execution on\na Linux Desktop system when the user tries to open a crafted document.\n","status":"published","published":"2025-07-19T17:55:11Z","modified":"2026-04-16T04:42:06.011958937Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15319-1","title":"djvulibre-3.5.29-1.1 on GA media","description":"These are all security issues fixed in the djvulibre-3.5.29-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-08T00:00:00Z","modified":"2026-03-23T04:53:38.584487Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02695-1","title":"Security update for djvulibre","description":"This update for djvulibre fixes the following issues:\n\n- CVE-2025-53367: Fixed a bug where a crafted document may lead to an out of bound write. (bsc#1245773)\n","status":"published","published":"2025-08-05T08:08:58Z","modified":"2026-02-04T03:02:47.059991Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02703-1","title":"Security update for djvulibre","description":"This update for djvulibre fixes the following issues:\n\n- CVE-2025-53367: Fixed a bug where a crafted document may lead to an out of bound write. (bsc#1245773)\n","status":"published","published":"2025-08-05T09:33:05Z","modified":"2026-02-04T02:44:46.532382Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"USN-7631-1","title":"djvulibre vulnerability","description":"It was discovered that DjVuLibre incorrectly handled certain memory\noperations. If a user or automated system were tricked into processing a\nspecially crafted DjVu file, a remote attacker could cause applications\nto stop responding or crash, resulting in a denial of service, or possibly\nexecute arbitrary code.","status":"published","published":"2025-07-09T12:20:21Z","modified":"2026-04-22T10:59:50.354803Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}