CVE-2020-36023
published 2023-08-11CVE-2020-36023: An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to…
PriorityP425medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.93%
56.1th percentile
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | poppler | < poppler 22.08.0-2 (bookworm) | poppler 22.08.0-2 (bookworm) |
| freedesktop | poppler | — | — |
| freedesktop | poppler | >= 0 < 20.09.0-3.1+deb11u2 | 20.09.0-3.1+deb11u2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 0.86.1-0ubuntu1.3 | 0.86.1-0ubuntu1.3 |
| freedesktop | poppler | >= 0 < 0.41.0-0ubuntu1.16+esm3 | 0.41.0-0ubuntu1.16+esm3 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm1 | 0.62.0-2ubuntu2.14+esm1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2023-08-17·CVSS 6.5
CVE-2020-36023 [MEDIUM] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: Several security issues were fixed in poppler.
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2020-36023, CVE-2020-36024)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
poppler: Stack-Overflow in `FoFiType1C::cvtGlyph`
vendor_redhat·2023-08-11·CVSS 6.5
CVE-2020-36023 [MEDIUM] CWE-119 poppler: Stack-Overflow in `FoFiType1C::cvtGlyph`
poppler: Stack-Overflow in `FoFiType1C::cvtGlyph`
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
A flaw was found in the Poppler package. This flaw allows attackers to possibly cause a denial of service via a crafted .pdf file to the FoFiType1C::cvtGlyph function.
Package: poppler (Red Hat Enterprise Linux 6) - Out of support scope
Package: poppler (Red Hat Enterprise Linux 7) - Out of support scope
Package: gimp:flatpak/poppler (Red Hat Enterprise Linux 8) - Will not fix
Package: inkscape:flatpak/poppler (Red Hat Enterprise Linux 8) - Will not fix
Package: libreoffice:flatpak/poppler (Red Hat Enterprise Linux 8) - Will not fix
Package: poppler (Red Ha
Debian
CVE-2020-36023: poppler - An issue was discovered in freedesktop poppler version 20.12.1, allows remote at...
vendor_debian·2020·CVSS 6.5
CVE-2020-36023 [MEDIUM] CVE-2020-36023: poppler - An issue was discovered in freedesktop poppler version 20.12.1, allows remote at...
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
Scope: local
bookworm: resolved (fixed in 22.08.0-2)
bullseye: resolved (fixed in 20.09.0-3.1+deb11u2)
forky: resolved (fixed in 22.08.0-2)
sid: resolved (fixed in 22.08.0-2)
trixie: resolved (fixed in 22.08.0-2)
OSV
poppler vulnerabilities
osv·2023-08-17·CVSS 6.5
CVE-2020-36023 [MEDIUM] poppler vulnerabilities
poppler vulnerabilities
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2020-36023, CVE-2020-36024)
OSV
CVE-2020-36023: An issue was discovered in freedesktop poppler version 20
osv·2023-08-11·CVSS 6.5
CVE-2020-36023 [MEDIUM] CVE-2020-36023: An issue was discovered in freedesktop poppler version 20
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
GHSA
GHSA-xrv4-xm8w-pm47: An issue was discovered in freedesktop poppler version 20
ghsa_unreviewed·2023-08-11
CVE-2020-36023 [MEDIUM] CWE-835 GHSA-xrv4-xm8w-pm47: An issue was discovered in freedesktop poppler version 20
An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013https://lists.debian.org/debian-lts-announce/2023/08/msg00017.htmlhttps://gitlab.freedesktop.org/poppler/poppler/-/issues/1013https://lists.debian.org/debian-lts-announce/2023/08/msg00017.htmlhttps://lists.debian.org/debian-lts-announce/2025/04/msg00037.html
2023-08-11
Published