SUSE-SU-2023:4562-1: Security update for poppler
This update for poppler fixes the following issues: CVE-2019-9545: Fixed an uncontrolled recursion issue that could cause a crash (bsc#1128114). CVE-2022-37052: Fixed a crash that could be triggered when opening a crafted file (bsc#1214726). CVE-2020-36023: Fixed a stack bugger overflow in FoFiType1C:cvtGlyph (bsc#1214256).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libpoppler89to a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler89-debuginfoto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/poppler-debugsourceto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/poppler-toolsto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler-develto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler-cpp0-debuginfoto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler-cpp0to a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler-glib-develto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler-glib8-debuginfoto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-Poppler-0_18-0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/poppler-tools-debuginfoto a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler-glib8to a version that resolves this vulnerability.Fixed in 0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler89to a version that resolves this vulnerability.Fixed in 32bit-0.79.0-150200.3.26.1 - Upgrade
Upgrade
suse/libpoppler89to a version that resolves this vulnerability.Fixed in 32bit-debuginfo-0.79.0-150200.3.26.1 - Upgrade
Upgrade
Basesystem Module 15-SP4to a version that resolves this vulnerability.Patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4562=1 - Upgrade
Upgrade
Basesystem Module 15-SP5to a version that resolves this vulnerability.Patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4562=1 - Upgrade
Upgrade
SUSE Manager Proxy 4.2to a version that resolves this vulnerability.Patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4562=1 - Upgrade
Upgrade
SUSE Manager Retail Branch Server 4.2to a version that resolves this vulnerability.Patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-4562=1 - Upgrade
Upgrade
SUSE Manager Server 4.2to a version that resolves this vulnerability.Patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4562=1 - Upgrade
Upgrade
openSUSE Leap 15.4to a version that resolves this vulnerability.Patch openSUSE-SLE-15.4-2023-4562=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What attacker interaction is required to trigger the fixed issues?
The update notes identify crashes from opening a crafted file for CVE-2022-37052. They also describe uncontrolled recursion and a stack buffer overflow, but do not specify a delivery method or additional attacker prerequisites.
Which installed components should be checked for this update?
Check for the listed Poppler packages: libpoppler89, poppler-tools, libpoppler-cpp0, libpoppler-devel, libpoppler-glib-devel, poppler-debugsource, and the associated debuginfo packages. Systems with any of these installed should verify that the SUSE security update has been applied.