SUSE update for poppler
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2025-43718 CVE-2025-52885 |
| CWE-ID | CWE-674 CWE-416 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Basesystem Module Operating systems & Components / Operating system SUSE Package Hub 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system libpoppler-cpp0-64bit Operating systems & Components / Operating system package or component libpoppler-glib8-64bit-debuginfo Operating systems & Components / Operating system package or component libpoppler135-64bit Operating systems & Components / Operating system package or component libpoppler-qt5-1-64bit Operating systems & Components / Operating system package or component libpoppler135-64bit-debuginfo Operating systems & Components / Operating system package or component libpoppler-qt5-1-64bit-debuginfo Operating systems & Components / Operating system package or component libpoppler-cpp0-64bit-debuginfo Operating systems & Components / Operating system package or component libpoppler-glib8-64bit Operating systems & Components / Operating system package or component libpoppler-glib8-32bit Operating systems & Components / Operating system package or component libpoppler-cpp0-32bit-debuginfo Operating systems & Components / Operating system package or component libpoppler-cpp0-32bit Operating systems & Components / Operating system package or component libpoppler135-32bit-debuginfo Operating systems & Components / Operating system package or component libpoppler-glib8-32bit-debuginfo Operating systems & Components / Operating system package or component libpoppler-qt5-1-32bit Operating systems & Components / Operating system package or component libpoppler135-32bit Operating systems & Components / Operating system package or component libpoppler-qt5-1-32bit-debuginfo Operating systems & Components / Operating system package or component poppler-tools-debuginfo Operating systems & Components / Operating system package or component typelib-1_0-Poppler-0_18 Operating systems & Components / Operating system package or component libpoppler-glib8-debuginfo Operating systems & Components / Operating system package or component libpoppler-qt6-devel Operating systems & Components / Operating system package or component libpoppler-cpp0-debuginfo Operating systems & Components / Operating system package or component libpoppler-qt5-1 Operating systems & Components / Operating system package or component libpoppler-qt6-3-debuginfo Operating systems & Components / Operating system package or component libpoppler-glib-devel Operating systems & Components / Operating system package or component libpoppler-cpp0 Operating systems & Components / Operating system package or component libpoppler-qt6-3 Operating systems & Components / Operating system package or component libpoppler135-debuginfo Operating systems & Components / Operating system package or component poppler-debugsource Operating systems & Components / Operating system package or component libpoppler-glib8 Operating systems & Components / Operating system package or component poppler-qt5-debugsource Operating systems & Components / Operating system package or component poppler-qt6-debugsource Operating systems & Components / Operating system package or component libpoppler-qt5-devel Operating systems & Components / Operating system package or component poppler-tools Operating systems & Components / Operating system package or component libpoppler135 Operating systems & Components / Operating system package or component libpoppler-devel Operating systems & Components / Operating system package or component libpoppler-qt5-1-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Uncontrolled Recursion
EUVDB-ID: #VU116637
Risk: Medium
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-43718
CWE-ID:
CWE-674 - Uncontrolled Recursion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncontrolled recursion when handling deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document. A remote attacker can pass a specially crafted PDF document to the application and perform a denial of service (DoS) attack.
MitigationUpdate the affected package poppler to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP6 - 15-SP7
SUSE Package Hub 15: 15-SP6 - 15-SP7
SUSE Linux Enterprise Real Time 15: SP6 - SP7
SUSE Linux Enterprise Server for SAP Applications 15: SP6 - SP7
SUSE Linux Enterprise Server 15: SP6 - SP7
SUSE Linux Enterprise Desktop 15: SP6 - SP7
openSUSE Leap: 15.6
libpoppler-cpp0-64bit: before 24.03.0-150600.3.24.1
libpoppler-glib8-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler135-64bit: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-64bit: before 24.03.0-150600.3.24.1
libpoppler135-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-cpp0-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-glib8-64bit: before 24.03.0-150600.3.24.1
libpoppler-glib8-32bit: before 24.03.0-150600.3.24.1
libpoppler-cpp0-32bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-cpp0-32bit: before 24.03.0-150600.3.24.1
libpoppler135-32bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-glib8-32bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-32bit: before 24.03.0-150600.3.24.1
libpoppler135-32bit: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-32bit-debuginfo: before 24.03.0-150600.3.24.1
poppler-tools-debuginfo: before 24.03.0-150600.3.24.1
typelib-1_0-Poppler-0_18: before 24.03.0-150600.3.24.1
libpoppler-glib8-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt6-devel: before 24.03.0-150600.3.24.1
libpoppler-cpp0-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt5-1: before 24.03.0-150600.3.24.1
libpoppler-qt6-3-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-glib-devel: before 24.03.0-150600.3.24.1
libpoppler-cpp0: before 24.03.0-150600.3.24.1
libpoppler-qt6-3: before 24.03.0-150600.3.24.1
libpoppler135-debuginfo: before 24.03.0-150600.3.24.1
poppler-debugsource: before 24.03.0-150600.3.24.1
libpoppler-glib8: before 24.03.0-150600.3.24.1
poppler-qt5-debugsource: before 24.03.0-150600.3.24.1
poppler-qt6-debugsource: before 24.03.0-150600.3.24.1
libpoppler-qt5-devel: before 24.03.0-150600.3.24.1
poppler-tools: before 24.03.0-150600.3.24.1
libpoppler135: before 24.03.0-150600.3.24.1
libpoppler-devel: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-debuginfo: before 24.03.0-150600.3.24.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-tools-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:typelib-1_0-poppler-0_18:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt6-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt6-3-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt6-3:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-qt5-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-qt6-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20253779-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use-after-free
EUVDB-ID: #VU117378
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2025-52885
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the StructTreeRoot class. A remote attacker can pass a specially crafted PDF file to the application, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected package poppler to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP6 - 15-SP7
SUSE Package Hub 15: 15-SP6 - 15-SP7
SUSE Linux Enterprise Real Time 15: SP6 - SP7
SUSE Linux Enterprise Server for SAP Applications 15: SP6 - SP7
SUSE Linux Enterprise Server 15: SP6 - SP7
SUSE Linux Enterprise Desktop 15: SP6 - SP7
openSUSE Leap: 15.6
libpoppler-cpp0-64bit: before 24.03.0-150600.3.24.1
libpoppler-glib8-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler135-64bit: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-64bit: before 24.03.0-150600.3.24.1
libpoppler135-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-cpp0-64bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-glib8-64bit: before 24.03.0-150600.3.24.1
libpoppler-glib8-32bit: before 24.03.0-150600.3.24.1
libpoppler-cpp0-32bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-cpp0-32bit: before 24.03.0-150600.3.24.1
libpoppler135-32bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-glib8-32bit-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-32bit: before 24.03.0-150600.3.24.1
libpoppler135-32bit: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-32bit-debuginfo: before 24.03.0-150600.3.24.1
poppler-tools-debuginfo: before 24.03.0-150600.3.24.1
typelib-1_0-Poppler-0_18: before 24.03.0-150600.3.24.1
libpoppler-glib8-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt6-devel: before 24.03.0-150600.3.24.1
libpoppler-cpp0-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-qt5-1: before 24.03.0-150600.3.24.1
libpoppler-qt6-3-debuginfo: before 24.03.0-150600.3.24.1
libpoppler-glib-devel: before 24.03.0-150600.3.24.1
libpoppler-cpp0: before 24.03.0-150600.3.24.1
libpoppler-qt6-3: before 24.03.0-150600.3.24.1
libpoppler135-debuginfo: before 24.03.0-150600.3.24.1
poppler-debugsource: before 24.03.0-150600.3.24.1
libpoppler-glib8: before 24.03.0-150600.3.24.1
poppler-qt5-debugsource: before 24.03.0-150600.3.24.1
poppler-qt6-debugsource: before 24.03.0-150600.3.24.1
libpoppler-qt5-devel: before 24.03.0-150600.3.24.1
poppler-tools: before 24.03.0-150600.3.24.1
libpoppler135: before 24.03.0-150600.3.24.1
libpoppler-devel: before 24.03.0-150600.3.24.1
libpoppler-qt5-1-debuginfo: before 24.03.0-150600.3.24.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-tools-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:typelib-1_0-poppler-0_18:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt6-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt6-3-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-cpp0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt6-3:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-glib8:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-qt5-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-qt6-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:poppler-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler135:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpoppler-qt5-1-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20253779-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
