CVE-2023-34872

NameCVE-2023-34872
DescriptionA vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1042811

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
poppler (PTS)jessie, jessie (lts)0.26.5-2+deb8u16fixed
stretch (security)0.48.0-2+deb9u4fixed
stretch (lts), stretch0.48.0-2+deb9u6fixed
buster (security), buster, buster (lts)0.71.0-5+deb10u3fixed
bullseye (security), bullseye20.09.0-3.1+deb11u1fixed
bookworm22.12.0-2vulnerable
sid, trixie24.08.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
popplersourceexperimental23.08.0-1
popplersourcejessie(not affected)
popplersourcestretch(not affected)
popplersourcebuster(not affected)
popplersourcebullseye(not affected)
popplersource(unstable)24.02.0-21042811

Notes

[bookworm] - poppler <no-dsa> (Minor issue)
[bullseye] - poppler <not-affected> (Vulnerable code introduced later)
[buster] - poppler <not-affected> (Vulnerable code introduced later)
Introduced by: https://gitlab.freedesktop.org/poppler/poppler/-/commit/fa494b780ab69ef04ba7447ab6d8fc3b46373e59 (poppler-21.08.0)
Fixed by: https://gitlab.freedesktop.org/poppler/poppler/-/commit/591235c8b6c65a2eee88991b9ae73490fd9afdfe (poppler-23.06.0)
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1399
[stretch] - poppler <not-affected> (Vulnerable code introduced later)
[jessie] - poppler <not-affected> (Vulnerable code introduced later)

Search for package or bug name: Reporting problems