A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6b20b7807a advisory.

    Security fix for  CVE-2023-34872.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f0be0daaa5 advisory.

    Security fix for  CVE-2023-34872.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4eff9e2cd6 advisory.

    Backport fix for CVE-2023-34872.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4285cca9bf advisory.

    Backport fix for CVE-2023-34872.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4363-1 advisory.

  - A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service     due to a failure in markObject. (CVE-2022-37052)

  - A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of     Service (DoS) (crash) via a crafted PDF file in OutlineItem::open. (CVE-2023-34872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4291-1 advisory.

  - A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of     Service (DoS) (crash) via a crafted PDF file in OutlineItem::open. (CVE-2023-34872)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-371 advisory.

    2024-07-17: CVE-2022-27337 was added to this advisory.

    A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of     Service (DoS) via a crafted PDF file. (CVE-2022-27337)

    A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of     Service (DoS) (crash) via a crafted PDF file in OutlineItem::open. (CVE-2023-34872)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6273-1 advisory.

    Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker     could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only     affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27337)

    It was discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could     possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-34872)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186604	Fedora 38 : poppler (2023-6b20b7807a)	Nessus	Fedora Local Security Checks	medium
186597	Fedora 37 : poppler (2023-f0be0daaa5)	Nessus	Fedora Local Security Checks	medium
186459	Fedora 38 : mingw-poppler (2023-4eff9e2cd6)	Nessus	Fedora Local Security Checks	medium
186454	Fedora 39 : mingw-poppler (2023-4285cca9bf)	Nessus	Fedora Local Security Checks	medium
184408	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : poppler (SUSE-SU-2023:4363-1)	Nessus	SuSE Local Security Checks	medium
184106	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : poppler (SUSE-SU-2023:4291-1)	Nessus	SuSE Local Security Checks	medium
182449	Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2023-371)	Nessus	Amazon Linux Local Security Checks	medium
179334	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : poppler vulnerabilities (USN-6273-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2023-34872

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium