The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3998-1 advisory.

  - Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial     of service via crafted input. (CVE-2020-23804)

  - An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial     of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. (CVE-2020-36024)

  - In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service     (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled     in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of     CVE-2018-20662. (CVE-2022-37050)

  - An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service     because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
    (CVE-2022-37051)

  - An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to     denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an     embedded file. (CVE-2022-38349)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : poppler (SUSE-SU-2023:3998-1)

high Nessus Plugin ID 182744

Version 1.0