Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
EUVDB-ID: #VU81718
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-23804
CWE-ID:
CWE-674 - Uncontrolled Recursion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncontrolled recursion in pdfinfo and pdftops. A remote attacker can pass a specially crafted document to application and perform a denial of service (DoS) attack.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
poppler-help: before 0.90.0-6
poppler-glib-doc: before 0.90.0-6
poppler-qt5-devel: before 0.90.0-6
poppler-glib-devel: before 0.90.0-6
poppler-glib: before 0.90.0-6
poppler-debuginfo: before 0.90.0-6
poppler-cpp: before 0.90.0-6
poppler-debugsource: before 0.90.0-6
poppler-devel: before 0.90.0-6
poppler-utils: before 0.90.0-6
poppler-cpp-devel: before 0.90.0-6
poppler-qt5: before 0.90.0-6
poppler: before 0.90.0-6
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1611
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU82598
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-37050
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the PDFDoc::savePageAs() function in PDFDoc.c. A remote attacker can trick the victim to open a specially crafted PDF file and perform a denial of service (DoS) attack.
Note, the vulnerability exists due to incomplete patch for #VU16830 (CVE-2018-20662).
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
poppler-help: before 0.90.0-6
poppler-glib-doc: before 0.90.0-6
poppler-qt5-devel: before 0.90.0-6
poppler-glib-devel: before 0.90.0-6
poppler-glib: before 0.90.0-6
poppler-debuginfo: before 0.90.0-6
poppler-cpp: before 0.90.0-6
poppler-debugsource: before 0.90.0-6
poppler-devel: before 0.90.0-6
poppler-utils: before 0.90.0-6
poppler-cpp-devel: before 0.90.0-6
poppler-qt5: before 0.90.0-6
poppler: before 0.90.0-6
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1611
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU82599
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-37051
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion in pdfunite.cc. A remote attacker can trick the victim to open a specially crafted PDF file and crash the application.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
poppler-help: before 0.90.0-6
poppler-glib-doc: before 0.90.0-6
poppler-qt5-devel: before 0.90.0-6
poppler-glib-devel: before 0.90.0-6
poppler-glib: before 0.90.0-6
poppler-debuginfo: before 0.90.0-6
poppler-cpp: before 0.90.0-6
poppler-debugsource: before 0.90.0-6
poppler-devel: before 0.90.0-6
poppler-utils: before 0.90.0-6
poppler-cpp-devel: before 0.90.0-6
poppler-qt5: before 0.90.0-6
poppler: before 0.90.0-6
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1611
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU82597
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-37052
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion in Object::getString(). A remote attacker can trick the victim to open a specially crafted file and crash the application.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
poppler-help: before 0.90.0-6
poppler-glib-doc: before 0.90.0-6
poppler-qt5-devel: before 0.90.0-6
poppler-glib-devel: before 0.90.0-6
poppler-glib: before 0.90.0-6
poppler-debuginfo: before 0.90.0-6
poppler-cpp: before 0.90.0-6
poppler-debugsource: before 0.90.0-6
poppler-devel: before 0.90.0-6
poppler-utils: before 0.90.0-6
poppler-cpp-devel: before 0.90.0-6
poppler-qt5: before 0.90.0-6
poppler: before 0.90.0-6
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1611
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU82600
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-38349
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the PDFDoc::replacePageDict() function in PDFDoc.cc. A remote attacker can trick the victim to open a specially crafted PDF file and crash the application.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
poppler-help: before 0.90.0-6
poppler-glib-doc: before 0.90.0-6
poppler-qt5-devel: before 0.90.0-6
poppler-glib-devel: before 0.90.0-6
poppler-glib: before 0.90.0-6
poppler-debuginfo: before 0.90.0-6
poppler-cpp: before 0.90.0-6
poppler-debugsource: before 0.90.0-6
poppler-devel: before 0.90.0-6
poppler-utils: before 0.90.0-6
poppler-cpp-devel: before 0.90.0-6
poppler-qt5: before 0.90.0-6
poppler: before 0.90.0-6
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1611
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU16830
Risk: Low
CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2018-20662
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a wrong return value from PDFDoc::setup when an xref data structure is mishandled during extractPDFSubtype processing. A remote attacker can trick the victim into opening a specially crafter PDF file cause application crash by Object.h SIGABRT.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP2
poppler-help: before 0.90.0-6
poppler-glib-doc: before 0.90.0-6
poppler-qt5-devel: before 0.90.0-6
poppler-glib-devel: before 0.90.0-6
poppler-glib: before 0.90.0-6
poppler-debuginfo: before 0.90.0-6
poppler-cpp: before 0.90.0-6
poppler-debugsource: before 0.90.0-6
poppler-devel: before 0.90.0-6
poppler-utils: before 0.90.0-6
poppler-cpp-devel: before 0.90.0-6
poppler-qt5: before 0.90.0-6
poppler: before 0.90.0-6
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1611
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.