{"id":"CLSA-2026-1787732795","summary":"Fix CVE(s): CVE-2020-23804, CVE-2025-32365","details":"   * SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine()\n     (JBIG2Stream.cc) via a crafted JBIG2 stream, from a misplaced isOk check\n     - debian/patches/CVE-2025-32365.patch: add the isOk() guard at the top of\n       JBIG2Bitmap::combine() so every caller is protected against\n       out-of-bounds reads on a not-OK bitmap (upstream commit 1f151565,\n       adapted to poppler 0.62 GBool/Guint)\n     - CVE-2025-32365\n   * SECURITY UPDATE: uncontrolled recursion / stack overflow in the XRefStm\n     chain parser (XRef.cc) via a crafted PDF, causing denial of service\n     - debian/patches/CVE-2020-23804.patch: cap the XRefStm chain at 4096\n       entries in XRef::readXRefTable() to stop the readXRef/readXRefTable\n       recursion from exhausting the stack on crafted PDFs (upstream commit\n       ec8a43c8)\n     - CVE-2020-23804","modified":"2026-10-26T09:32:03.774012903Z","published":"2026-08-26T08:26:47Z","upstream":["CVE-2020-23804","CVE-2025-32365"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787732795.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-23804"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32365"}],"affected":[{"package":{"name":"gir1.2-poppler-0.18","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/gir1.2-poppler-0.18?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-cpp-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-cpp-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-cpp0v5","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-cpp0v5?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-glib-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-glib-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-glib-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-glib-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-glib8","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-glib8?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-private-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-private-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-qt5-1","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-qt5-1?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler-qt5-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler-qt5-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"libpoppler73","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpoppler73?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}},{"package":{"name":"poppler-utils","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/poppler-utils?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"}}],"schema_version":"1.9.0"}