CVE-2022-37050
published 2023-08-22CVE-2022-37050: In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in…
PriorityP427medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.92%
55.8th percentile
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | poppler | < poppler 22.08.0-2 (bookworm) | poppler 22.08.0-2 (bookworm) |
| freedesktop | poppler | — | — |
| freedesktop | poppler | >= 0 < 20.09.0-3.1+deb11u2 | 20.09.0-3.1+deb11u2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 0.86.1-0ubuntu1.4 | 0.86.1-0ubuntu1.4 |
| freedesktop | poppler | >= 0 < 22.02.0-2ubuntu0.3 | 22.02.0-2ubuntu0.3 |
| freedesktop | poppler | >= 0 < 0.41.0-0ubuntu1.16+esm4 | 0.41.0-0ubuntu1.16+esm4 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm3 | 0.62.0-2ubuntu2.14+esm3 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm2 | 0.62.0-2ubuntu2.14+esm2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
poppler regression
vendor_ubuntu·2023-11-28·CVSS 7.5
[HIGH] poppler regression
Title: poppler regression
Summary: USN-6508-1 caused some minor regressions in poppler.
USN-6508-1 fixed vulnerabilities in poppler. The update introduced
one minor regression in Ubuntu 18.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafte
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2023-11-23·CVSS 7.5
CVE-2022-37051 [HIGH] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: Several security issues were fixed in poppler.
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,
CVE-2022-37052, CVE-2022-38349)
Instructions: In general, a standard system update
Red Hat
poppler: abort in PDFDoc::savePageAs in PDFDoc.c
vendor_redhat·2022-07-27·CVSS 6.5
CVE-2022-37050 [MEDIUM] CWE-400 poppler: abort in PDFDoc::savePageAs in PDFDoc.c
poppler: abort in PDFDoc::savePageAs in PDFDoc.c
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
A vulnerability was found in poppler, where PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing.
Package: poppler (Red Hat Enterprise Linux 6) - Out of support scope
Package: compat-poppler022 (Red Hat Enterprise Linux 7) - Out of support scope
Package: poppler (Red Hat Enterpri
Debian
CVE-2022-37050: poppler - In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a ...
vendor_debian·2022·CVSS 6.5
CVE-2022-37050 [MEDIUM] CVE-2022-37050: poppler - In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a ...
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
Scope: local
bookworm: resolved (fixed in 22.08.0-2)
bullseye: resolved (fixed in 20.09.0-3.1+deb11u2)
forky: resolved (fixed in 22.08.0-2)
sid: resolved (fixed in 22.08.0-2)
trixie: resolved (fixed in 22.08.0-2)
OSV
poppler regression
osv·2023-11-28·CVSS 7.5
[HIGH] poppler regression
poppler regression
USN-6508-1 fixed vulnerabilities in poppler. The update introduced
one minor regression in Ubuntu 18.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a
OSV
poppler vulnerabilities
osv·2023-11-23·CVSS 7.5
CVE-2020-23804 [HIGH] poppler vulnerabilities
poppler vulnerabilities
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,
CVE-2022-37052, CVE-2022-38349)
OSV
CVE-2022-37050: In Poppler 22
osv·2023-08-22·CVSS 6.5
CVE-2022-37050 [MEDIUM] CVE-2022-37050: In Poppler 22
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
GHSA
GHSA-j6x9-fqfr-79q4: In Poppler 22
ghsa_unreviewed·2023-08-22·CVSS 6.5
CVE-2022-37050 [MEDIUM] CWE-400 GHSA-j6x9-fqfr-79q4: In Poppler 22
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.freedesktop.org/poppler/poppler/-/commit/dcd5bd8238ea448addd102ff045badd0aca1b990https://gitlab.freedesktop.org/poppler/poppler/-/issues/1274https://lists.debian.org/debian-lts-announce/2023/10/msg00022.htmlhttps://gitlab.freedesktop.org/poppler/poppler/-/commit/dcd5bd8238ea448addd102ff045badd0aca1b990https://gitlab.freedesktop.org/poppler/poppler/-/issues/1274https://lists.debian.org/debian-lts-announce/2023/10/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2025/04/msg00037.html
2023-08-22
Published