CVE-2025-43903
Fixed in a distro release EPSS <1%CVSS 4.3
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
Products: freedesktop poppler
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | poppler | 22.12.0-2+deb12u3 |
| Debian 13 | poppler | 25.03.0-4 |
| Debian 14 | poppler | 25.03.0-4 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | poppler | 24.03.0-150600.3.13.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | poppler | 24.03.0-150600.3.13.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | poppler-qt5 | 24.03.0-150600.3.13.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | poppler-qt6 | 24.03.0-150600.3.13.1 |
| Ubuntu 20.04 LTS | poppler | 0.86.1-0ubuntu1.7 |
| Ubuntu 22.04 LTS | poppler | 22.02.0-2ubuntu0.8 |
| Ubuntu 24.04 LTS | poppler | 24.02.0-1ubuntu9.4 |
| Ubuntu Pro 18.04 LTS | poppler | 0.62.0-2ubuntu2.14+esm6 |
| openSUSE Leap 15.6 | poppler | 24.03.0-150600.3.13.1 |
| openSUSE Leap 15.6 | poppler-qt5 | 24.03.0-150600.3.13.1 |
| openSUSE Leap 15.6 | poppler-qt6 | 24.03.0-150600.3.13.1 |