PT-2023-5944 · Poppler+4 · Poppler+4

Published 2023-08-11 · Updated 2023-12-08 · CVE-2020-23804

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Poppler version 0.89.0

Description The issue is related to uncontrolled recursion in the Poppler library for rendering PDF files. This can be exploited by a remote attacker to cause a denial of service via crafted input. The vulnerability affects the pdfinfo and pdftops components.

Recommendations For Poppler version 0.89.0, consider disabling the pdfinfo and pdftops functions until a patch is available to prevent potential denial of service attacks.

Exploit

Fix

DoS

Improper Resource Release

NULL Pointer Dereference

Uncontrolled Recursion

Weakness Enumeration

CWE-404

CWE-476

CWE-674

Related Identifiers

BDU:2023-06640

BDU:2023-06641

CVE-2020-23804

DLA-3620-1

OESA-2023-1561

OESA-2023-1611

OESA-2023-1612

OESA-2023-1613

OPENSUSE-SU-2023_3983-1

OPENSUSE-SU-2023_3998-1

SUSE-SU-2023:3981-1

SUSE-SU-2023:3982-1

SUSE-SU-2023:3983-1

SUSE-SU-2023:3998-1

SUSE-SU-2023_3981-1

SUSE-SU-2023_3982-1

SUSE-SU-2023_3983-1

SUSE-SU-2023_3998-1

USN-6508-1

USN-6508-2

Affected Products

Astra Linux

Linuxmint

Poppler

Suse

Ubuntu

References · 105

• 🔥 https://gitlab.freedesktop.org/poppler/poppler/-/issues/936 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23804 · Security Note
• https://ubuntu.com/security/notices/USN-6508-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1612 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/poppler · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37051 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3981-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05859 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37050 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05861 · Security Note
• https://bdu.fstec.ru/vul/2023-05860 · Security Note
• https://osv.dev/vulnerability/DLA-3620-1 · Vendor Advisory