Description
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 24.02.0-2 | — |
| Debian 13 | poppler | 24.02.0-2 | — |
| Debian 12 | poppler | 22.12.0-2+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | poppler | 22.02.0-2ubuntu0.2 | USN-6273-1 |
| Ubuntu 20.04 LTS | poppler | 0.86.1-0ubuntu1.2 | USN-6273-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | poppler | 22.01.0-150400.3.16.1 | SUSE-SU-2023:4363-1, SUSE-SU-2023:4291-1 |
| SLES 15 SP5 | poppler-qt5 | 23.01.0-150500.3.5.1 | SUSE-SU-2023:4291-1 |
| SLES 15 SP4 | poppler +1 | 22.01.0-150400.3.16.1 | SUSE-SU-2023:4363-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | poppler | 23.01.0-150500.3.5.2 | SUSE-SU-2023:4291-1 |
| openSUSE Leap 15.5 | poppler-qt5 +1 | 23.01.0-150500.3.5.1 | SUSE-SU-2023:4291-1 |
| openSUSE Leap 15.4 | poppler +2 | 22.01.0-150400.3.16.1 | SUSE-SU-2023:4363-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | poppler +7 | 22.08.0-3.amzn2023.0.4 | ALAS2023-2023-371 |
Advisories 8
- USN-6273-1 poppler vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2023:4291-1 Security update for poppler SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4363-1 Security update for poppler SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- ALAS2023-2023-371 Moderate: poppler security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 17, 2024
- ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
- WID-SEC-2023-1921 poppler: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 21, 2023
References
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/591235c8b6c65a2eee88991b9ae73490fd9afdfe
- https://gitlab.freedesktop.org/poppler/poppler/-/issues/1399
- FEDORA-2023-4285cca9bf vendor-advisory
- FEDORA-2023-4eff9e2cd6 vendor-advisory
- FEDORA-2023-f0be0daaa5 vendor-advisory
- FEDORA-2023-6b20b7807a vendor-advisory