Improper verification of cryptographic signature in Poppler - CVE-2025-43903

Vulnerability identifier: #VU108758

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2025-43903

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to incorrect adbe.pkcs7.sha1 signature verification in NSSCryptoSignBackend.cc. A remote attacker can create a specially crafted file that bypasses signature verification process and allows to perform document forgery.

Poppler
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
libpoppler73 (Ubuntu package)
poppler-utils (Ubuntu package)
libpoppler97 (Ubuntu package)
poppler-debuginfo
poppler-help
poppler-cpp-devel
poppler-cpp
poppler
poppler-glib-doc
poppler-utils
poppler-qt5-devel
poppler-qt5
poppler-glib-devel
poppler-glib
poppler-devel
poppler-debugsource
libpoppler118 (Ubuntu package)
poppler-qt6
poppler-qt6-devel
libpoppler134 (Ubuntu package)
poppler-tools-debuginfo
libpoppler-qt5-1-32bit
libpoppler-glib8-32bit-debuginfo
libpoppler-cpp0-32bit
libpoppler-glib8-32bit
libpoppler135-32bit
libpoppler-glib-devel
libpoppler-qt6-3-debuginfo
libpoppler-glib8
libpoppler-qt5-1-debuginfo
poppler-qt5-debugsource
libpoppler-qt6-devel
libpoppler135-32bit-debuginfo
libpoppler-qt5-1
libpoppler-cpp0-debuginfo
libpoppler-devel
libpoppler-qt5-devel
libpoppler-cpp0
libpoppler-qt6-3
typelib-1_0-Poppler-0_18
poppler-qt6-debugsource
libpoppler-glib8-debuginfo
libpoppler135-debuginfo
libpoppler135
libpoppler-cpp0-32bit-debuginfo
poppler-tools
libpoppler135-64bit
libpoppler135-64bit-debuginfo
libpoppler-qt5-1-64bit-debuginfo
libpoppler-glib8-64bit-debuginfo
libpoppler-glib8-64bit
libpoppler-qt5-1-32bit-debuginfo
libpoppler-cpp0-64bit-debuginfo
libpoppler-qt5-1-64bit
libpoppler-cpp0-64bit
libpoppler140 (Ubuntu package)
libpoppler147 (Ubuntu package)
poppler-doc

Install updates from vendor's website.

Poppler - update to 25.04.0
libpoppler73 (Ubuntu package) - update to Ubuntu Pro
poppler-utils (Ubuntu package) - addressed in versions Ubuntu Pro, 0.86.1-0ubuntu1.7, 22.02.0-2ubuntu0.8, 24.02.0-1ubuntu9.4, 24.08.0-1ubuntu0.3, 25.03.0-3ubuntu1
libpoppler97 (Ubuntu package) - update to 0.86.1-0ubuntu1.7
poppler-debuginfo - addressed in versions 0.90.0-16, 23.12.0-7
poppler-help - addressed in versions 0.90.0-16, 23.12.0-7
poppler-cpp-devel - addressed in versions 0.90.0-16, 23.12.0-7
poppler-cpp - addressed in versions 0.90.0-16, 23.12.0-7
poppler - addressed in versions 0.90.0-16, 23.12.0-7
poppler-glib-doc - addressed in versions 0.90.0-16, 23.12.0-7
poppler-utils - addressed in versions 0.90.0-16, 23.12.0-7
poppler-qt5-devel - addressed in versions 0.90.0-16, 23.12.0-7
poppler-qt5 - addressed in versions 0.90.0-16, 23.12.0-7
poppler-glib-devel - addressed in versions 0.90.0-16, 23.12.0-7
poppler-glib - addressed in versions 0.90.0-16, 23.12.0-7
poppler-devel - addressed in versions 0.90.0-16, 23.12.0-7
poppler-debugsource - addressed in versions 0.90.0-16, 23.12.0-7
libpoppler118 (Ubuntu package) - update to 22.02.0-2ubuntu0.8
poppler-qt6 - update to 23.12.0-7
poppler-qt6-devel - update to 23.12.0-7
libpoppler134 (Ubuntu package) - update to 24.02.0-1ubuntu9.4
poppler-tools-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-qt5-1-32bit - update to 24.03.0-150600.3.13.1
libpoppler-glib8-32bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-cpp0-32bit - update to 24.03.0-150600.3.13.1
libpoppler-glib8-32bit - update to 24.03.0-150600.3.13.1
libpoppler135-32bit - update to 24.03.0-150600.3.13.1
libpoppler-glib-devel - update to 24.03.0-150600.3.13.1
libpoppler-qt6-3-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-glib8 - update to 24.03.0-150600.3.13.1
libpoppler-qt5-1-debuginfo - update to 24.03.0-150600.3.13.1
poppler-qt5-debugsource - update to 24.03.0-150600.3.13.1
libpoppler-qt6-devel - update to 24.03.0-150600.3.13.1
libpoppler135-32bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-qt5-1 - update to 24.03.0-150600.3.13.1
libpoppler-cpp0-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-devel - update to 24.03.0-150600.3.13.1
libpoppler-qt5-devel - update to 24.03.0-150600.3.13.1
libpoppler-cpp0 - update to 24.03.0-150600.3.13.1
libpoppler-qt6-3 - update to 24.03.0-150600.3.13.1
poppler-debugsource - update to 24.03.0-150600.3.13.1
typelib-1_0-Poppler-0_18 - update to 24.03.0-150600.3.13.1
poppler-qt6-debugsource - update to 24.03.0-150600.3.13.1
libpoppler-glib8-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler135-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler135 - update to 24.03.0-150600.3.13.1
libpoppler-cpp0-32bit-debuginfo - update to 24.03.0-150600.3.13.1
poppler-tools - update to 24.03.0-150600.3.13.1
libpoppler135-64bit - update to 24.03.0-150600.3.13.1
libpoppler135-64bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-qt5-1-64bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-glib8-64bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-glib8-64bit - update to 24.03.0-150600.3.13.1
libpoppler-qt5-1-32bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-cpp0-64bit-debuginfo - update to 24.03.0-150600.3.13.1
libpoppler-qt5-1-64bit - update to 24.03.0-150600.3.13.1
libpoppler-cpp0-64bit - update to 24.03.0-150600.3.13.1
libpoppler140 (Ubuntu package) - update to 24.08.0-1ubuntu0.3
libpoppler147 (Ubuntu package) - update to 25.03.0-3ubuntu1
poppler-doc - update to 25.04.0-1
poppler-utils - update to 25.04.0-1
poppler-qt5-devel - update to 25.04.0-1
poppler-qt5 - update to 25.04.0-1
poppler-glib-devel - update to 25.04.0-1
poppler-glib - update to 25.04.0-1
poppler-devel - update to 25.04.0-1
poppler-cpp-devel - update to 25.04.0-1
poppler-cpp - update to 25.04.0-1
poppler - update to 25.04.0-1
poppler-glib-doc - update to 25.04.0-1

• https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669

• Incorrect signature verification in Poppler
• SUSE update for poppler
• Ubuntu update for poppler
• openEuler 24.03 LTS SP1 update for poppler
• openEuler 24.03 LTS update for poppler
• Anolis OS update for poppler
• openEuler 22.03 LTS SP3 update for poppler
• openEuler 20.03 LTS SP4 update for poppler
• openEuler 22.03 LTS SP4 update for poppler