CVE-2022-37051
published 2023-08-22CVE-2022-37051: An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream…
PriorityP426medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.96%
57.0th percentile
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | poppler | < poppler 22.08.0-2 (bookworm) | poppler 22.08.0-2 (bookworm) |
| freedesktop | poppler | — | — |
| freedesktop | poppler | >= 0 < 20.09.0-3.1+deb11u2 | 20.09.0-3.1+deb11u2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 0.86.1-0ubuntu1.4 | 0.86.1-0ubuntu1.4 |
| freedesktop | poppler | >= 0 < 22.02.0-2ubuntu0.3 | 22.02.0-2ubuntu0.3 |
| freedesktop | poppler | >= 0 < 0.41.0-0ubuntu1.16+esm4 | 0.41.0-0ubuntu1.16+esm4 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm3 | 0.62.0-2ubuntu2.14+esm3 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm2 | 0.62.0-2ubuntu2.14+esm2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
poppler regression
osv·2023-11-28·CVSS 7.5
[HIGH] poppler regression
poppler regression
USN-6508-1 fixed vulnerabilities in poppler. The update introduced
one minor regression in Ubuntu 18.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a
OSV
poppler vulnerabilities
osv·2023-11-23·CVSS 7.5
CVE-2020-23804 [HIGH] poppler vulnerabilities
poppler vulnerabilities
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,
CVE-2022-37052, CVE-2022-38349)
GHSA
GHSA-fh54-998j-j424: An issue was discovered in Poppler 22
ghsa_unreviewed·2023-08-22
CVE-2022-37051 [MEDIUM] CWE-617 GHSA-fh54-998j-j424: An issue was discovered in Poppler 22
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
OSV
CVE-2022-37051: An issue was discovered in Poppler 22
osv·2023-08-22·CVSS 6.5
CVE-2022-37051 [MEDIUM] CVE-2022-37051: An issue was discovered in Poppler 22
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
Ubuntu
poppler regression
vendor_ubuntu·2023-11-28·CVSS 7.5
[HIGH] poppler regression
Title: poppler regression
Summary: USN-6508-1 caused some minor regressions in poppler.
USN-6508-1 fixed vulnerabilities in poppler. The update introduced
one minor regression in Ubuntu 18.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafte
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2023-11-23·CVSS 7.5
CVE-2022-37051 [HIGH] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: Several security issues were fixed in poppler.
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,
CVE-2022-37052, CVE-2022-38349)
Instructions: In general, a standard system update
Red Hat
poppler: abort in main() in pdfunite.cc
vendor_redhat·2022-07-28·CVSS 6.5
CVE-2022-37051 [MEDIUM] CWE-400 poppler: abort in main() in pdfunite.cc
poppler: abort in main() in pdfunite.cc
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
An issue was discovered in Poppler, where a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
Package: poppler (Red Hat Enterprise Linux 6) - Out of support scope
Package: compat-poppler022 (Red Hat Enterprise Linux 7) - Out of support scope
Package: poppler (Red Hat Enterprise Linux 7) - Out of support scope
Package: cups-container (Red Hat Enterprise Linux 8) - Not affected
Package: gimp-flatpak-container (Red Hat Enterprise Linux 8) - Affected
Package: g
Debian
CVE-2022-37051: poppler - An issue was discovered in Poppler 22.07.0. There is a reachable abort which lea...
vendor_debian·2022·CVSS 6.5
CVE-2022-37051 [MEDIUM] CVE-2022-37051: poppler - An issue was discovered in Poppler 22.07.0. There is a reachable abort which lea...
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
Scope: local
bookworm: resolved (fixed in 22.08.0-2)
bullseye: resolved (fixed in 20.09.0-3.1+deb11u2)
forky: resolved (fixed in 22.08.0-2)
sid: resolved (fixed in 22.08.0-2)
trixie: resolved (fixed in 22.08.0-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.freedesktop.org/poppler/poppler/-/commit/4631115647c1e4f0482ffe0491c2f38d2231337bhttps://gitlab.freedesktop.org/poppler/poppler/-/issues/1276https://lists.debian.org/debian-lts-announce/2023/10/msg00022.htmlhttps://gitlab.freedesktop.org/poppler/poppler/-/commit/4631115647c1e4f0482ffe0491c2f38d2231337bhttps://gitlab.freedesktop.org/poppler/poppler/-/issues/1276https://lists.debian.org/debian-lts-announce/2023/10/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2025/04/msg00037.html
2023-08-22
Published