Skip to content
OpenAdvisories
Medium ALAS2-2023-2243 2 CVEs

Moderate: poppler security update (Amazon Linux 2)

Published Aug 31, 2023 · Updated Sep 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37050: In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. CVE-2020-18839: Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 poppler 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-cpp 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-cpp-devel 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-debuginfo 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-demos 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-devel 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-glib 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-glib-devel 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-qt 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-qt-devel 0:0.26.5-43.amzn2.1.4
Amazon Linux · 2 poppler-utils 0:0.26.5-43.amzn2.1.4

Vulnerabilities 2

  • Medium 6.5
    CVE-2022-37050

    In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes …

    poppler poppler Debian Ubuntu
  • Unscored —
    CVE-2020-18839

    Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.

    poppler Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-18839.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-37050.html