Improper verification of cryptographic signature in Poppler - CVE-2025-43903

Vulnerability identifier: #VU108758

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-43903

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Poppler
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
libpoppler73 (Ubuntu package)
poppler-utils (Ubuntu package)
libpoppler97 (Ubuntu package)
poppler-debuginfo
poppler-help
poppler-cpp-devel
poppler-cpp
poppler
poppler-glib-doc
poppler-utils
poppler-qt5-devel
poppler-qt5
poppler-glib-devel
poppler-glib
poppler-devel
poppler-debugsource
libpoppler118 (Ubuntu package)
poppler-qt6
poppler-qt6-devel
libpoppler134 (Ubuntu package)
poppler-tools-debuginfo
libpoppler-qt5-1-32bit
libpoppler-glib8-32bit-debuginfo
libpoppler-cpp0-32bit
libpoppler-glib8-32bit
libpoppler135-32bit
libpoppler-glib-devel
libpoppler-qt6-3-debuginfo
libpoppler-glib8
libpoppler-qt5-1-debuginfo
poppler-qt5-debugsource
libpoppler-qt6-devel
libpoppler135-32bit-debuginfo
libpoppler-qt5-1
libpoppler-cpp0-debuginfo
libpoppler-devel
libpoppler-qt5-devel
libpoppler-cpp0
libpoppler-qt6-3
typelib-1_0-Poppler-0_18
poppler-qt6-debugsource
libpoppler-glib8-debuginfo
libpoppler135-debuginfo
libpoppler135
libpoppler-cpp0-32bit-debuginfo
poppler-tools
libpoppler135-64bit
libpoppler135-64bit-debuginfo
libpoppler-qt5-1-64bit-debuginfo
libpoppler-glib8-64bit-debuginfo
libpoppler-glib8-64bit
libpoppler-qt5-1-32bit-debuginfo
libpoppler-cpp0-64bit-debuginfo
libpoppler-qt5-1-64bit
libpoppler-cpp0-64bit
libpoppler140 (Ubuntu package)
libpoppler147 (Ubuntu package)
poppler-doc

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to incorrect adbe.pkcs7.sha1 signature verification in NSSCryptoSignBackend.cc. A remote attacker can create a specially crafted file that bypasses signature verification process and allows to perform document forgery.

Install updates from vendor's website.

• https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669