CVE-2024-56378: Medium severity Freedesktop poppler vulnerability
Last updated 16 January 2025
Other sources
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/popplerto a version that resolves this vulnerability.Fixed in 22.12.0-2+deb12u1 - Upgrade
Upgrade
debian/popplerto a version that resolves this vulnerability.Fixed in 24.08.0-4 - Upgrade
Upgrade
debian/popplerto a version that resolves this vulnerability.Fixed in 22.12.0-2+deb12u2Fixed in 22.12.0-2+deb12u3Fixed in 25.03.0-5+deb13u4Fixed in 25.03.0-5+deb13u3Fixed in 26.07.0-3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56378?
CVE-2024-56378 has been classified as a medium severity vulnerability due to its potential for causing out-of-bounds read errors.
How do I fix CVE-2024-56378?
To fix CVE-2024-56378, upgrade to libpoppler.so version 24.12.0 or later.
Which versions of Poppler are affected by CVE-2024-56378?
Poppler versions up to and including 24.12.0 are affected by CVE-2024-56378.
Is CVE-2024-56378 exploitable remotely?
CVE-2024-56378 may be exploitable remotely if an attacker can craft specific JBIG2 images.
What impact does CVE-2024-56378 have on applications?
CVE-2024-56378 can lead to unexpected behavior or application crashes when processing certain JBIG2 images.