{"schemaVersion":3,"id":"SUSE-SU-2021:3854-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for poppler\n\nThis update for poppler fixes the following issues:\n\n- CVE-2017-18267: Fixed an infinite recursion that would allow remote attackers to cause a denial of service (bsc#1092945).\n- CVE-2018-13988: Added an improper implementation check which otherwise could allow buffer overflows, memory corruption, and denial of service (bsc#1102531).\n- CVE-2018-16646: Fixed an infinite recursion which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1107597).\n- CVE-2018-18897: Fixed a memory leak (bsc#1114966).\n- CVE-2018-19058: Fixed a bug which could allow a denial-of-service attack via a specially crafted PDF file (bsc#1115187).\n- CVE-2018-19059: Fixed an out-of-bounds read access which could allow a denial-of-service attack (bsc#1115186).\n- CVE-2018-19060: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115185).\n- CVE-2018-19149: Fixed a NULL pointer dereference which could allow a denial-of-service attack (bsc#1115626).\n- CVE-2018-20481: Fixed a NULL pointer dereference while handling unallocated XRef entries which could allow a denial-of-service attack (bsc#1120495).\n- CVE-2018-20551: Fixed a reachable assertion which could allow a denial-of-service attack through specially crafted PDF files (bsc#1120496).\n- CVE-2018-20650: Fixed a reachable assertion which could allow denial-of-service through specially crafted PDF files (bsc#1120939).\n- CVE-2018-20662: Fixed a bug which could potentially crash the running process by SIGABRT resulting in a denial-of-service attack through a specially crafted PDF file (bsc#1120956).\n- CVE-2019-10871: Fixed a heap-based buffer  over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc (bsc#1131696).\n- CVE-2019-10872: Fixed a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc (bsc#1131722).\n- CVE-2019-14494: Fixed a divide-by-zero error in the function SplashOutputDev::tilingPatternFill (bsc#1143950).\n- CVE-2019-7310: Fixed a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) that allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document (bsc#1124150).\n- CVE-2019-9200: Fixed a heap-based buffer underwrite which could allow denial-of-service attack through a specially crafted PDF file (bsc#1127329)\n- CVE-2019-9631: Fixed a heap-based buffer over-read  in the CairoRescaleBox.cc downsample_row_box_filter function (bsc#1129202).\n- CVE-2019-9903: Fixed excessive stack consumption in the Dict::find() method, which can be triggered by passing a crafted pdf file to the pdfunite binary (bsc#1130229).\n- CVE-2019-9959: Fixed integer overflow that made it possible to allocate a large memory chunk on the heap with a size controlled by an attacker (bsc#1142465).\n- CVE-2020-27778: Fixed buffer overflow vulnerability in pdftohtml (bsc#1179163).","dates":{"published":"2021-12-01T16:00:36.000Z","modified":"2026-02-04T02:27:58.636Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"poppler&distro=SUSE Enterprise Storage 6","name":"poppler","label":"poppler&distro=SUSE Enterprise Storage 6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Enterprise Storage 6","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise Server 15 SP1-BCL","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise Server 15 SP1-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise Server 15 SP1-BCL","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise Server 15 SP1-LTSS","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise Server 15 SP1-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise Server 15 SP1-LTSS","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise Server 15-LTSS","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise Server 15-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise Server 15-LTSS","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise Server for SAP Applications 15","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise Server for SAP Applications 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise Server for SAP Applications 15","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"poppler&distro=SUSE Linux Enterprise Workstation Extension 15 SP2","name":"poppler","label":"poppler&distro=SUSE Linux Enterprise Workstation Extension 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/poppler&distro=SUSE Linux Enterprise Workstation Extension 15 SP2","purlType":"rpm","versions":[{"text":"< 0.62.0-4.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.62.0-4.6.1","eol":null,"hubHref":null}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213854-1/","label":"www.suse.com/support/update/announcement/2021/suse-su-20213854-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1092945","label":"bugzilla.suse.com/1092945","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1102531","label":"bugzilla.suse.com/1102531","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1107597","label":"bugzilla.suse.com/1107597","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1114966","label":"bugzilla.suse.com/1114966","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1115185","label":"bugzilla.suse.com/1115185","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1115186","label":"bugzilla.suse.com/1115186","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1115187","label":"bugzilla.suse.com/1115187","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1115626","label":"bugzilla.suse.com/1115626","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120495","label":"bugzilla.suse.com/1120495","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120496","label":"bugzilla.suse.com/1120496","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120939","label":"bugzilla.suse.com/1120939","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120956","label":"bugzilla.suse.com/1120956","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1124150","label":"bugzilla.suse.com/1124150","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1127329","label":"bugzilla.suse.com/1127329","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1129202","label":"bugzilla.suse.com/1129202","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1130229","label":"bugzilla.suse.com/1130229","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1131696","label":"bugzilla.suse.com/1131696","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1131722","label":"bugzilla.suse.com/1131722","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1142465","label":"bugzilla.suse.com/1142465","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1143950","label":"bugzilla.suse.com/1143950","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1179163","label":"bugzilla.suse.com/1179163","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18267","label":"www.suse.com/security/cve/CVE-2017-18267","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13988","label":"www.suse.com/security/cve/CVE-2018-13988","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16646","label":"www.suse.com/security/cve/CVE-2018-16646","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18897","label":"www.suse.com/security/cve/CVE-2018-18897","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19058","label":"www.suse.com/security/cve/CVE-2018-19058","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19059","label":"www.suse.com/security/cve/CVE-2018-19059","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19060","label":"www.suse.com/security/cve/CVE-2018-19060","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19149","label":"www.suse.com/security/cve/CVE-2018-19149","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20481","label":"www.suse.com/security/cve/CVE-2018-20481","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20551","label":"www.suse.com/security/cve/CVE-2018-20551","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20650","label":"www.suse.com/security/cve/CVE-2018-20650","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20662","label":"www.suse.com/security/cve/CVE-2018-20662","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10871","label":"www.suse.com/security/cve/CVE-2019-10871","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10872","label":"www.suse.com/security/cve/CVE-2019-10872","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14494","label":"www.suse.com/security/cve/CVE-2019-14494","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7310","label":"www.suse.com/security/cve/CVE-2019-7310","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9200","label":"www.suse.com/security/cve/CVE-2019-9200","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9631","label":"www.suse.com/security/cve/CVE-2019-9631","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9903","label":"www.suse.com/security/cve/CVE-2019-9903","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9959","label":"www.suse.com/security/cve/CVE-2019-9959","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27778","label":"www.suse.com/security/cve/CVE-2020-27778","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2017-18267","CVE-2018-13988","CVE-2018-16646","CVE-2018-18897","CVE-2018-19058","CVE-2018-19059","CVE-2018-19060","CVE-2018-19149","CVE-2018-20481","CVE-2018-20551","CVE-2018-20650","CVE-2018-20662","CVE-2019-10871","CVE-2019-10872","CVE-2019-14494","CVE-2019-7310","CVE-2019-9200","CVE-2019-9631","CVE-2019-9903","CVE-2019-9959","CVE-2020-27778"],"downstream":[],"duplicates":[],"related":["CVE-2017-18267","CVE-2018-13988","CVE-2018-16646","CVE-2018-18897","CVE-2018-19058","CVE-2018-19059","CVE-2018-19060","CVE-2018-19149","CVE-2018-20481","CVE-2018-20551","CVE-2018-20650","CVE-2018-20662","CVE-2019-10871","CVE-2019-10872","CVE-2019-14494","CVE-2019-7310","CVE-2019-9200","CVE-2019-9631","CVE-2019-9903","CVE-2019-9959","CVE-2020-27778"]},"timeline":[{"kind":"published","date":"2021-12-01T16:00:36.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:27:58.636Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T01:45:01.526Z","stale":false,"partial":false}}