Skip to content
OpenAdvisories
Medium ALAS2-2023-2281 3 CVEs

Moderate: poppler security update (Amazon Linux 2)

Published Sep 27, 2023 · Updated Oct 5, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38349: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. CVE-2020-36024: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. CVE-2020-36023: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 poppler 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-cpp 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-cpp-devel 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-debuginfo 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-demos 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-devel 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-glib 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-glib-devel 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-qt 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-qt-devel 0:0.26.5-43.amzn2.1.5
Amazon Linux · 2 poppler-utils 0:0.26.5-43.amzn2.1.5

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-36023.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-36024.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-38349.html