An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Poppler | Freedesktop | 20.12.1 (including) | 20.12.1 (including) |
| Red Hat Enterprise Linux 8 | RedHat | poppler-0:20.11.0-11.el8 | * |
| Poppler | Ubuntu | bionic | * |
| Poppler | Ubuntu | esm-infra/bionic | * |
| Poppler | Ubuntu | esm-infra/focal | * |
| Poppler | Ubuntu | esm-infra/xenial | * |
| Poppler | Ubuntu | focal | * |
| Poppler | Ubuntu | trusty | * |
| Poppler | Ubuntu | upstream | * |
| Poppler | Ubuntu | xenial | * |
Potential Mitigations
References
- https://gitlab.freedesktop.org/poppler/poppler/-/issues/1016
- https://lists.debian.org/debian-lts-announce/2023/08/msg00017.html
- https://gitlab.freedesktop.org/poppler/poppler/-/issues/1016
- https://lists.debian.org/debian-lts-announce/2023/08/msg00017.html
- https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html