Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-10118: A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | poppler | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-cpp | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-cpp-debuginfo | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-cpp-devel | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-debuginfo | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-debugsource | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-devel | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib-debuginfo | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib-devel | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib-doc | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-utils | 0:24.08.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-utils-debuginfo | 0:24.08.0-1.amzn2023.0.1 |
Vulnerabilities 1
-
High 7.8
Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-10118.html