PT-2023-5242 · Poppler+6 · Poppler+6

Published 2023-08-22 · Updated 2025-07-02 · CVE-2022-37050

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Poppler version 22.07.0

Description The issue is related to the handling of the xref data structure in getCatalog processing, which can be exploited by crafting a malicious PDF file. This can cause a denial-of-service, leading to application crashes with SIGABRT. The vulnerability is a result of an incomplete patch.

Recommendations For Poppler version 22.07.0, consider applying a patch or fix that properly handles the xref data structure in getCatalog processing to prevent denial-of-service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-400

Related Identifiers

BDU:2023-05858

CVE-2022-37050

DLA-3620-1

DLA-4141-1

OESA-2023-1561

OESA-2023-1611

OESA-2023-1612

OESA-2023-1613

OPENSUSE-SU-2023_3947-1

OPENSUSE-SU-2023_3983-1

OPENSUSE-SU-2023_3998-1

SUSE-SU-2023:3947-1

SUSE-SU-2023:3981-1

SUSE-SU-2023:3982-1

SUSE-SU-2023:3983-1

SUSE-SU-2023:3998-1

SUSE-SU-2023_3947-1

USN-6508-1

USN-6508-2

Affected Products

Astra Linux

Debian

Linuxmint

Poppler

Red Os

Suse

Ubuntu

References · 108

• 🔥 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1274 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23804 · Security Note
• https://gitlab.freedesktop.org/poppler/poppler/-/commit/dcd5bd8238ea448addd102ff045badd0aca1b990 · Patch
• https://ubuntu.com/security/notices/USN-6508-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1612 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07624 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/poppler · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37051 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3981-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05859 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37050 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37050 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36023 · Security Note