SUSE update for poppler
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2019-9545 CVE-2020-36023 CVE-2022-37052 |
| CWE-ID | CWE-119 CWE-835 CWE-617 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Basesystem Module Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system libpoppler89-32bit-debuginfo Operating systems & Components / Operating system package or component libpoppler89-32bit Operating systems & Components / Operating system package or component typelib-1_0-Poppler-0_18 Operating systems & Components / Operating system package or component poppler-tools-debuginfo Operating systems & Components / Operating system package or component libpoppler-glib8 Operating systems & Components / Operating system package or component poppler-tools Operating systems & Components / Operating system package or component libpoppler-cpp0 Operating systems & Components / Operating system package or component libpoppler-devel Operating systems & Components / Operating system package or component libpoppler-glib8-debuginfo Operating systems & Components / Operating system package or component libpoppler-cpp0-debuginfo Operating systems & Components / Operating system package or component libpoppler-glib-devel Operating systems & Components / Operating system package or component libpoppler89 Operating systems & Components / Operating system package or component poppler-debugsource Operating systems & Components / Operating system package or component libpoppler89-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU19603
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9545
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing PDF files within the JBIG2Stream::readTextRegion() function in JBIG2Stream.cc. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package poppler to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP4 - 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP4 - SP5
SUSE Linux Enterprise Server 15: SP4 - SP5
SUSE Linux Enterprise Real Time 15: SP4 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP4 - SP5
SUSE Linux Enterprise Desktop 15: SP4 - SP5
SUSE Manager Retail Branch Server: 4.2 - 4.3
SUSE Manager Server: 4.2 - 4.3
SUSE Manager Proxy: 4.2 - 4.3
openSUSE Leap: 15.4
libpoppler89-32bit-debuginfo: before 0.79.0-150200.3.26.1
libpoppler89-32bit: before 0.79.0-150200.3.26.1
typelib-1_0-Poppler-0_18: before 0.79.0-150200.3.26.1
poppler-tools-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-glib8: before 0.79.0-150200.3.26.1
poppler-tools: before 0.79.0-150200.3.26.1
libpoppler-cpp0: before 0.79.0-150200.3.26.1
libpoppler-devel: before 0.79.0-150200.3.26.1
libpoppler-glib8-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-cpp0-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-glib-devel: before 0.79.0-150200.3.26.1
libpoppler89: before 0.79.0-150200.3.26.1
poppler-debugsource: before 0.79.0-150200.3.26.1
libpoppler89-debuginfo: before 0.79.0-150200.3.26.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:
- cpe:2.3:o:suse:libpoppler89-32bit-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89-32bit:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:typelib-1_0-poppler-0_18:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-tools-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib8:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-tools:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-cpp0:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib8-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-cpp0-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-debugsource:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89-debuginfo:*:*:*:*:*:suse_linux:*:
http://www.suse.com/support/update/announcement/2023/suse-su-20234562-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Infinite loop
EUVDB-ID: #VU79769
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-36023
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the FoFiType1C::cvtGlyph() function. A remote attacker can pass a specially crafted PDF file to the server, consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package poppler to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP4 - 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP4 - SP5
SUSE Linux Enterprise Server 15: SP4 - SP5
SUSE Linux Enterprise Real Time 15: SP4 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP4 - SP5
SUSE Linux Enterprise Desktop 15: SP4 - SP5
SUSE Manager Retail Branch Server: 4.2 - 4.3
SUSE Manager Server: 4.2 - 4.3
SUSE Manager Proxy: 4.2 - 4.3
openSUSE Leap: 15.4
libpoppler89-32bit-debuginfo: before 0.79.0-150200.3.26.1
libpoppler89-32bit: before 0.79.0-150200.3.26.1
typelib-1_0-Poppler-0_18: before 0.79.0-150200.3.26.1
poppler-tools-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-glib8: before 0.79.0-150200.3.26.1
poppler-tools: before 0.79.0-150200.3.26.1
libpoppler-cpp0: before 0.79.0-150200.3.26.1
libpoppler-devel: before 0.79.0-150200.3.26.1
libpoppler-glib8-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-cpp0-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-glib-devel: before 0.79.0-150200.3.26.1
libpoppler89: before 0.79.0-150200.3.26.1
poppler-debugsource: before 0.79.0-150200.3.26.1
libpoppler89-debuginfo: before 0.79.0-150200.3.26.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:
- cpe:2.3:o:suse:libpoppler89-32bit-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89-32bit:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:typelib-1_0-poppler-0_18:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-tools-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib8:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-tools:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-cpp0:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib8-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-cpp0-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-debugsource:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89-debuginfo:*:*:*:*:*:suse_linux:*:
http://www.suse.com/support/update/announcement/2023/suse-su-20234562-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Reachable Assertion
EUVDB-ID: #VU82597
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-37052
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion in Object::getString(). A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package poppler to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP4 - 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP4 - SP5
SUSE Linux Enterprise Server 15: SP4 - SP5
SUSE Linux Enterprise Real Time 15: SP4 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP4 - SP5
SUSE Linux Enterprise Desktop 15: SP4 - SP5
SUSE Manager Retail Branch Server: 4.2 - 4.3
SUSE Manager Server: 4.2 - 4.3
SUSE Manager Proxy: 4.2 - 4.3
openSUSE Leap: 15.4
libpoppler89-32bit-debuginfo: before 0.79.0-150200.3.26.1
libpoppler89-32bit: before 0.79.0-150200.3.26.1
typelib-1_0-Poppler-0_18: before 0.79.0-150200.3.26.1
poppler-tools-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-glib8: before 0.79.0-150200.3.26.1
poppler-tools: before 0.79.0-150200.3.26.1
libpoppler-cpp0: before 0.79.0-150200.3.26.1
libpoppler-devel: before 0.79.0-150200.3.26.1
libpoppler-glib8-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-cpp0-debuginfo: before 0.79.0-150200.3.26.1
libpoppler-glib-devel: before 0.79.0-150200.3.26.1
libpoppler89: before 0.79.0-150200.3.26.1
poppler-debugsource: before 0.79.0-150200.3.26.1
libpoppler89-debuginfo: before 0.79.0-150200.3.26.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:
- cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:
- cpe:2.3:o:suse:libpoppler89-32bit-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89-32bit:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:typelib-1_0-poppler-0_18:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-tools-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib8:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-tools:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-cpp0:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib8-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-cpp0-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler-glib-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:poppler-debugsource:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libpoppler89-debuginfo:*:*:*:*:*:suse_linux:*:
http://www.suse.com/support/update/announcement/2023/suse-su-20234562-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
