PT-2020-6934 · Poppler+5 · Poppler+5

Published 2020-12-21 · Updated 2025-04-28 · CVE-2020-36023

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions poppler version 20.12.1

Description The issue allows remote attackers to cause a denial of service (DoS) via a crafted .pdf file to the cvtGlyph function of the FoFiType1C component. This is related to the execution of a loop with an inaccessible exit condition. Exploitation of the issue may allow a remote attacker to cause a denial of service using a specially crafted PDF file.

Recommendations For poppler version 20.12.1, consider disabling the cvtGlyph function of the FoFiType1C component as a temporary workaround until a patch is available.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-07624

CVE-2020-36023

DLA-3528-1

DLA-4141-1

MGASA-2023-0262

OPENSUSE-SU-2023_4187-1

OPENSUSE-SU-2023_4562-1

SUSE-SU-2023:4187-1

SUSE-SU-2023:4362-1

SUSE-SU-2023:4546-1

SUSE-SU-2023:4562-1

USN-6299-1

Affected Products

Astra Linux

Debian

Linuxmint

Suse

Ubuntu

Poppler

References · 54

• 🔥❌ https://github.com/PanguL4b/pocs/tree/master/xpdf/out-of-bounds-read-in-SplashXPath__strokeAdjust · Exploit, Deleted
• 🔥 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1013 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2023:4562-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36023 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36023 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36023 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3528-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4141-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36023 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6299-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0262.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:4546-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4187-1 · Vendor Advisory