Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-50422: An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream objects is not cleared upon program exit, allowing attackers to obtain sensitive PDF content via a memory dump.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cairo | 0:1.15.12-4.amzn2.0.1 |
| Amazon Linux · 2 | cairo-debuginfo | 0:1.15.12-4.amzn2.0.1 |
| Amazon Linux · 2 | cairo-devel | 0:1.15.12-4.amzn2.0.1 |
| Amazon Linux · 2 | cairo-gobject | 0:1.15.12-4.amzn2.0.1 |
| Amazon Linux · 2 | cairo-gobject-devel | 0:1.15.12-4.amzn2.0.1 |
| Amazon Linux · 2 | cairo-tools | 0:1.15.12-4.amzn2.0.1 |
Vulnerabilities 1
-
Low 2.9CVE-2025-50422 Public exploit
Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-50422.html