Bugzilla – Bug 1214726
VUL-0: CVE-2022-37052: poppler: reachable assertion due to a failure in markObject()
Last modified: 2023-12-07 08:35:27 UTC
CVE-2022-37052 A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37052 https://bugzilla.redhat.com/show_bug.cgi?id=2234530 https://www.cve.org/CVERecord?id=CVE-2022-37052 https://gitlab.freedesktop.org/poppler/poppler/-/commit/8677500399fc2548fa816b619580c2c07915a98c https://gitlab.freedesktop.org/poppler/poppler/-/issues/1278
I could not reproduce with 15sp4/poppler (22.01.0).
(In reply to Petr Gajdos from comment #2) > I could not reproduce with 15sp4/poppler (22.01.0). (even without no patches applied)
I am not able to reproduce even with 22.07.0. Tried also limit memory via ulimit, no success in reproducing.
Will submit for 15sp4,15sp2,15,12sp2,12/poppler. TW,15sp5/poppler are already fixed by version update.
SUSE-SU-2023:4270-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1128114, 1214726 CVE References: CVE-2019-9545, CVE-2022-37052 Sources used: openSUSE Leap 15.4 (src): poppler-0.62.0-150000.4.31.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4363-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1213888, 1214726 CVE References: CVE-2022-37052, CVE-2023-34872 Sources used: openSUSE Leap 15.4 (src): poppler-qt5-22.01.0-150400.3.16.1, poppler-22.01.0-150400.3.16.1, poppler-qt6-22.01.0-150400.3.16.1 Basesystem Module 15-SP4 (src): poppler-22.01.0-150400.3.16.1 SUSE Package Hub 15 15-SP4 (src): poppler-qt5-22.01.0-150400.3.16.1, poppler-22.01.0-150400.3.16.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): poppler-22.01.0-150400.3.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4362-1: An update that solves nine vulnerabilities can now be installed. Category: security (moderate) Bug References: 1112424, 1112428, 1128114, 1129202, 1140745, 1143570, 1214256, 1214723, 1214726 CVE References: CVE-2018-18454, CVE-2018-18456, CVE-2019-13287, CVE-2019-14292, CVE-2019-9545, CVE-2019-9631, CVE-2020-36023, CVE-2022-37052, CVE-2022-48545 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1 SUSE Linux Enterprise Server 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4546-1: An update that solves six vulnerabilities can now be installed. Category: security (moderate) Bug References: 1128114, 1129202, 1143570, 1214256, 1214723, 1214726 CVE References: CVE-2019-14292, CVE-2019-9545, CVE-2019-9631, CVE-2020-36023, CVE-2022-37052, CVE-2022-48545 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): poppler-0.24.4-14.41.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4562-1: An update that solves three vulnerabilities can now be installed. Category: security (moderate) Bug References: 1128114, 1214256, 1214726 CVE References: CVE-2019-9545, CVE-2020-36023, CVE-2022-37052 Sources used: Basesystem Module 15-SP5 (src): poppler-0.79.0-150200.3.26.1 SUSE Manager Proxy 4.2 (src): poppler-0.79.0-150200.3.26.1 SUSE Manager Retail Branch Server 4.2 (src): poppler-0.79.0-150200.3.26.1 SUSE Manager Server 4.2 (src): poppler-0.79.0-150200.3.26.1 openSUSE Leap 15.4 (src): poppler-0.79.0-150200.3.26.1 Basesystem Module 15-SP4 (src): poppler-0.79.0-150200.3.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.