From 529b31ef7f952da1a78e07e577d1a418ebbf0eda Mon Sep 17 00:00:00 2001 From: Yogita Urade Date: Tue, 14 Oct 2025 15:37:05 +0530 Subject: [PATCH] poppler: fix CVE-2025-43718 Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor). Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-43718 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408 Signed-off-by: Yogita Urade Signed-off-by: Gyorgy Sarvari --- .../poppler/poppler/CVE-2025-43718.patch | 31 +++++++++++++++++++ .../poppler/poppler_22.04.0.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2025-43718.patch diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2025-43718.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2025-43718.patch new file mode 100644 index 0000000000..5a1368885c --- /dev/null +++ b/meta-oe/recipes-support/poppler/poppler/CVE-2025-43718.patch @@ -0,0 +1,31 @@ +From f54b815672117c250420787c8c006de98e8c7408 Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid +Date: Wed, 26 Mar 2025 11:26:32 +0100 +Subject: [PATCH] Make sure regex doesn't stack overflow by limiting it + +Happens with very long pdfsubver strings when compiled with +-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto + +CVE: CVE-2025-43718 +Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408] + +Signed-off-by: Yogita Urade +--- + poppler/PDFDoc.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc +index abf6bb6..976bd78 100644 +--- a/poppler/PDFDoc.cc ++++ b/poppler/PDFDoc.cc +@@ -478,7 +478,7 @@ static PDFSubtypePart pdfPartFromString(PDFSubtype subtype, const std::string &p + + static PDFSubtypeConformance pdfConformanceFromString(const std::string &pdfsubver) + { +- const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]+)"); ++ const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]{1,3})"); + std::smatch match; + PDFSubtypeConformance pdfConf = subtypeConfNone; + +-- +2.40.0 diff --git a/meta-oe/recipes-support/poppler/poppler_22.04.0.bb b/meta-oe/recipes-support/poppler/poppler_22.04.0.bb index c624164560..0c4efab918 100644 --- a/meta-oe/recipes-support/poppler/poppler_22.04.0.bb +++ b/meta-oe/recipes-support/poppler/poppler_22.04.0.bb @@ -19,6 +19,7 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \ file://CVE-2025-52886-0002.patch \ file://CVE-2025-52886-0003.patch \ file://CVE-2025-52886-0004.patch \ + file://CVE-2025-43718.patch \ " SRC_URI[sha256sum] = "813fb4b90e7bda63df53205c548602bae728887a60f4048aae4dbd9b1927deff"