mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-14 05:49:57 +00:00
Code Issues Projects Releases Wiki Activity

poppler: fix CVE-2025-43718

Browse Source 
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption
and a SIGSEGV via deeply nested structures within the metadata (such
as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for
a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata,
and associated functions in PDFDoc, with deep recursion in the regex
executor (std::__detail::_Executor).

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-43718

Upstream patch:
https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Yogita Urade
2025-10-14 15:37:05 +05:30
committed by Gyorgy Sarvari
parent 5fd149feb4
commit 529b31ef7f
2 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/poppler/poppler/CVE-2025-43718.patch
+31
View File
@@ -0,0 +1,31 @@
From f54b815672117c250420787c8c006de98e8c7408 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Wed, 26 Mar 2025 11:26:32 +0100
Subject: [PATCH] Make sure regex doesn't stack overflow by limiting it
Happens with very long pdfsubver strings when compiled with
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto
CVE: CVE-2025-43718
Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408]
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
poppler/PDFDoc.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index abf6bb6..976bd78 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -478,7 +478,7 @@ static PDFSubtypePart pdfPartFromString(PDFSubtype subtype, const std::string &p
static PDFSubtypeConformance pdfConformanceFromString(const std::string &pdfsubver)
{
- const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]+)");
+ const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]{1,3})");
std::smatch match;
PDFSubtypeConformance pdfConf = subtypeConfNone;
--
2.40.0
meta-oe/recipes-support/poppler/poppler_22.04.0.bb
+1
View File
@@ -19,6 +19,7 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
file://CVE-2025-52886-0002.patch \
file://CVE-2025-52886-0003.patch \
file://CVE-2025-52886-0004.patch \
file://CVE-2025-43718.patch \
"
SRC_URI[sha256sum] = "813fb4b90e7bda63df53205c548602bae728887a60f4048aae4dbd9b1927deff"