Skip to content
OpenAdvisories
Medium ALAS2023-2023-371 2 CVEs

Moderate: poppler security update (Amazon Linux 2023)

Published Sep 27, 2023 · Updated Jul 17, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34872: A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open. CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2023 poppler 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-cpp 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-cpp-debuginfo 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-cpp-devel 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-debuginfo 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-debugsource 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-devel 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-glib 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-glib-debuginfo 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-glib-devel 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-glib-doc 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-utils 0:22.08.0-3.amzn2023.0.4
Amazon Linux · 2023 poppler-utils-debuginfo 0:22.08.0-3.amzn2023.0.4

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-27337.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-34872.html