Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002399 advisory.

    Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial     of service via crafted input.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6508-1 advisory.

    It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or an automated     system were tricked into opening a specially crafted PDF file, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2020-23804)

    It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or an automated     system were tricked into opening a specially crafted PDF file, a remote attacker could possibly use this     issue to cause a denial of service. (CVE-2022-37050, CVE-2022-37051, CVE-2022-37052, CVE-2022-38349)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3620 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3620-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     October 16, 2023                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : poppler     Version        : 0.71.0-5+deb10u3     CVE ID         : CVE-2020-23804 CVE-2022-37050 CVE-2022-37051

    Several vulnerabilities have been fixed in poppler,     a PDF rendering library.

    CVE-2020-23804

        Stack overflow in XRef::readXRefTable()

    CVE-2022-37050

        Crash in PDFDoc::savePageAs()

    CVE-2022-37051

        Crash in the pdfunite tool

    For Debian 10 buster, these problems have been fixed in version     0.71.0-5+deb10u3.

    We recommend that you upgrade your poppler packages.

    For the detailed security status of poppler please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/poppler

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3998-1 advisory.

    - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).
    - CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).
    - CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).
    - CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621).
    - CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of poppler installed on the remote host is prior to 0.26.5-43.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1852 advisory.

    Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial     of service via crafted input. (CVE-2020-23804)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3981-1 advisory.

    - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).
    - CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).
    - CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).
    - CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3983-1 advisory.

    - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).
    - CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).
    - CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).
    - CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621).
    - CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3982-1 advisory.

    - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422).
    - CVE-2020-36024: Fixed NULL Pointer Deference in `FoFiType1C:convertToType1` (bsc#1214257).
    - CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622).
    - CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621).
    - CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2282 advisory.

    Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial     of service via crafted input. (CVE-2020-23804)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
345493	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: poppler (UTSA-2023-002399)	Nessus	Unity Linux Local Security Checks	Local	high
186209	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : poppler vulnerabilities (USN-6508-1)	Nessus	Ubuntu Local Security Checks	Local	high
183199	Debian dla-3620 : gir1.2-poppler-0.18 - security update	Nessus	Debian Local Security Checks	Local	high
182744	SUSE SLED15: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2023:3998-1)	Nessus	SuSE Local Security Checks	Local	high
182718	Amazon Linux AMI : poppler (ALAS-2023-1852)	Nessus	Amazon Linux Local Security Checks	Local	high
182674	SUSE SLES12 Security Update : poppler (SUSE-SU-2023:3981-1)	Nessus	SuSE Local Security Checks	Local	high
182672	SUSE SLES15: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2023:3983-1)	Nessus	SuSE Local Security Checks	Local	high
182670	SUSE SLES12: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2023:3982-1)	Nessus	SuSE Local Security Checks	Local	high
182640	Amazon Linux 2 : poppler (ALAS-2023-2282)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2020-23804

high

Tenable Plugins

high

high

high

high

high

high

high

high

high