SUSE update for poppler
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2019-9545 CVE-2022-37052 |
| CWE-ID | CWE-119 CWE-617 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
openSUSE Leap Operating systems & Components / Operating system libpoppler73-32bit Operating systems & Components / Operating system package or component libpoppler73-32bit-debuginfo Operating systems & Components / Operating system package or component libpoppler73-debuginfo Operating systems & Components / Operating system package or component libpoppler73 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU19603
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2019-9545
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing PDF files within the JBIG2Stream::readTextRegion() function in JBIG2Stream.cc. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package poppler to the latest version.
Vulnerable software versionsopenSUSE Leap: 15.4
libpoppler73-32bit: before 0.62.0-150000.4.31.1
libpoppler73-32bit-debuginfo: before 0.62.0-150000.4.31.1
libpoppler73-debuginfo: before 0.62.0-150000.4.31.1
libpoppler73: before 0.62.0-150000.4.31.1
CPE2.3- cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpoppler73-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler73-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler73-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler73:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20234270-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Reachable Assertion
EUVDB-ID: #VU82597
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-37052
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion in Object::getString(). A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package poppler to the latest version.
Vulnerable software versionsopenSUSE Leap: 15.4
libpoppler73-32bit: before 0.62.0-150000.4.31.1
libpoppler73-32bit-debuginfo: before 0.62.0-150000.4.31.1
libpoppler73-debuginfo: before 0.62.0-150000.4.31.1
libpoppler73: before 0.62.0-150000.4.31.1
CPE2.3- cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpoppler73-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler73-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler73-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler73:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20234270-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
