PT-2024-36808 · Poppler+6 · Poppler+6

Published 2024-12-22 · Updated 2025-10-10 · CVE-2024-56378

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Poppler versions prior to 24.12.0

Description The issue is an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. This vulnerability occurs in the libpoppler.so file in Poppler.

Recommendations For versions prior to 24.12.0, as a temporary workaround, consider disabling the JBIG2Bitmap::combine function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2025-06968

CVE-2024-56378

DLA-4141-1

MGASA-2025-0022

OESA-2024-2602

OESA-2025-1018

OPENSUSE-SU-2024_4421-1

OPENSUSE-SU-2024_4422-1

OPENSUSE-SU-2024_4435-1

OPENSUSE-SU-2025:14616-1

SUSE-SU-2024:4421-1

SUSE-SU-2024:4422-1

SUSE-SU-2024:4423-1

SUSE-SU-2024:4432-1

SUSE-SU-2024:4435-1

SUSE-SU-2024_4423-1

SUSE-SU-2024_4432-1

SUSE-SU-2024_4435-1

USN-7213-1

Affected Products

Astra Linux

Debian

Linuxmint

Poppler

Red Os

Suse

Ubuntu

References · 54

• 🔥 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1553 · Exploit
• https://gitlab.freedesktop.org/poppler/poppler/-/commit/ade9b5ebed44b0c15522c27669ef6cdf93eff84e · Patch
• https://bdu.fstec.ru/vul/2025-06968 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:4432-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56378 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-56378 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-22024-56378 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4423-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-56378 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1018 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4435-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2602 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4422-1 · Vendor Advisory