Headline
Ubuntu Security Notice USN-6273-1
Ubuntu Security Notice 6273-1 - Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. It was discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04.
==========================================================================
Ubuntu Security Notice USN-6273-1
August 03, 2023
poppler vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
poppler could be made to crash if it opened a specially crafted file.
Software Description:
- poppler: PDF rendering library
Details:
Jieyong Ma discovered that poppler incorrectly handled certain malformed
PDF files. A remote attacker could possibly use this issue to cause poppler
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27337)
It was discovered that poppler incorrectly handled certain malformed PDF
files. A remote attacker could possibly use this issue to cause poppler to
crash, resulting in a denial of service. This issue only affected Ubuntu
22.04 LTS and Ubuntu 23.04. (CVE-2023-34872)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.04:
libpoppler126 22.12.0-2ubuntu1.1
Ubuntu 22.04 LTS:
libpoppler118 22.02.0-2ubuntu0.2
Ubuntu 20.04 LTS:
libpoppler97 0.86.1-0ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6273-1
CVE-2022-27337, CVE-2023-34872
Package Information:
https://launchpad.net/ubuntu/+source/poppler/22.12.0-2ubuntu1.1
https://launchpad.net/ubuntu/+source/poppler/22.02.0-2ubuntu0.2
https://launchpad.net/ubuntu/+source/poppler/0.86.1-0ubuntu1.2
Related news
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
An update for poppler is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-27337: poppler: A logic error in the Hints::Hints function can cause denial of service
An update for poppler is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-27337: poppler: A logic error in the Hints::Hints function can cause denial of service
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.