CVE-2022-37052
published 2023-08-22CVE-2022-37052: A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
PriorityP424medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.90%
55.3th percentile
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | poppler | < poppler 22.08.0-2 (bookworm) | poppler 22.08.0-2 (bookworm) |
| freedesktop | poppler | — | — |
| freedesktop | poppler | >= 0 < 20.09.0-3.1+deb11u2 | 20.09.0-3.1+deb11u2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 22.08.0-2 | 22.08.0-2 |
| freedesktop | poppler | >= 0 < 0.86.1-0ubuntu1.4 | 0.86.1-0ubuntu1.4 |
| freedesktop | poppler | >= 0 < 22.02.0-2ubuntu0.3 | 22.02.0-2ubuntu0.3 |
| freedesktop | poppler | >= 0 < 0.41.0-0ubuntu1.16+esm4 | 0.41.0-0ubuntu1.16+esm4 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm3 | 0.62.0-2ubuntu2.14+esm3 |
| freedesktop | poppler | >= 0 < 0.62.0-2ubuntu2.14+esm2 | 0.62.0-2ubuntu2.14+esm2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
poppler regression
osv·2023-11-28·CVSS 7.5
[HIGH] poppler regression
poppler regression
USN-6508-1 fixed vulnerabilities in poppler. The update introduced
one minor regression in Ubuntu 18.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a
OSV
poppler vulnerabilities
osv·2023-11-23·CVSS 7.5
CVE-2020-23804 [HIGH] poppler vulnerabilities
poppler vulnerabilities
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,
CVE-2022-37052, CVE-2022-38349)
GHSA
GHSA-527m-pccf-wf58: A reachable Object::getString assertion in Poppler 22
ghsa_unreviewed·2023-08-22
CVE-2022-37052 [MEDIUM] CWE-617 GHSA-527m-pccf-wf58: A reachable Object::getString assertion in Poppler 22
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
OSV
CVE-2022-37052: A reachable Object::getString assertion in Poppler 22
osv·2023-08-22·CVSS 6.5
CVE-2022-37052 [MEDIUM] CVE-2022-37052: A reachable Object::getString assertion in Poppler 22
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
Ubuntu
poppler regression
vendor_ubuntu·2023-11-28·CVSS 7.5
[HIGH] poppler regression
Title: poppler regression
Summary: USN-6508-1 caused some minor regressions in poppler.
USN-6508-1 fixed vulnerabilities in poppler. The update introduced
one minor regression in Ubuntu 18.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafte
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2023-11-23·CVSS 7.5
CVE-2022-37051 [HIGH] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: Several security issues were fixed in poppler.
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 16.04
LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-23804)
It was discovered that poppler incorrectly handled certain malformed PDF
files. If a user or an automated system were tricked into opening a
specially crafted PDF file, a remote attacker could possibly use this
issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051,
CVE-2022-37052, CVE-2022-38349)
Instructions: In general, a standard system update
Red Hat
poppler: reachable assertion due to a failure in markObject()
vendor_redhat·2022-07-28·CVSS 6.5
CVE-2022-37052 [MEDIUM] CWE-400 poppler: reachable assertion due to a failure in markObject()
poppler: reachable assertion due to a failure in markObject()
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
A vulnerability was found in Poppler, where a reachable assertion allows attackers to cause a denial of service due to a failure in markObject.
Package: poppler (Red Hat Enterprise Linux 6) - Out of support scope
Package: compat-poppler022 (Red Hat Enterprise Linux 7) - Out of support scope
Package: poppler (Red Hat Enterprise Linux 7) - Out of support scope
Package: cups-container (Red Hat Enterprise Linux 8) - Not affected
Package: gimp-flatpak-container (Red Hat Enterprise Linux 8) - Will not fix
Package: gimp:flatpak/poppler (Red Hat Enterprise Linux 8) - Affected
Package: poppler
Debian
CVE-2022-37052: poppler - A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to c...
vendor_debian·2022·CVSS 6.5
CVE-2022-37052 [MEDIUM] CVE-2022-37052: poppler - A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to c...
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
Scope: local
bookworm: resolved (fixed in 22.08.0-2)
bullseye: resolved (fixed in 20.09.0-3.1+deb11u2)
forky: resolved (fixed in 22.08.0-2)
sid: resolved (fixed in 22.08.0-2)
trixie: resolved (fixed in 22.08.0-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.freedesktop.org/poppler/poppler/-/commit/8677500399fc2548fa816b619580c2c07915a98chttps://gitlab.freedesktop.org/poppler/poppler/-/issues/1278https://gitlab.freedesktop.org/poppler/poppler/-/commit/8677500399fc2548fa816b619580c2c07915a98chttps://gitlab.freedesktop.org/poppler/poppler/-/issues/1278https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html
2023-08-22
Published