{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "freedesktop poppler: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/freedesktop--poppler/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/freedesktop--poppler/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · disclosed",
   "content_text": "Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · fixed in openSUSE Tumbleweed (poppler 26.10.0-1.1)",
   "content_text": "Fixed versions: poppler 26.10.0-1.1.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · fixed in Red Hat hummingbird 1 (poppler 0:26.08.0-1.3.hum1 and 19 more)",
   "content_text": "Fixed versions: poppler 0:26.08.0-1.3.hum1, poppler 0:26.08.0-1.4.hum1, poppler-cpp 0:26.08.0-1.3.hum1, poppler-cpp 0:26.08.0-1.4.hum1, poppler-cpp-devel 0:26.08.0-1.3.hum1, poppler-cpp-devel 0:26.08.0-1.4.hum1, poppler-devel 0:26.08.0-1.3.hum1, poppler-devel 0:26.08.0-1.4.hum1, poppler-glib 0:26.08.0-1.3.hum1, poppler-glib 0:26.08.0-1.4.hum1, poppler-glib-devel 0:26.08.0-1.3.hum1, poppler-glib-devel 0:26.08.0-1.4.hum1, poppler-glib-doc 0:26.08.0-1.3.hum1, poppler-glib-doc 0:26.08.0-1.4.hum1, poppler-qt6 0:26.08.0-1.3.hum1, poppler-qt6 0:26.08.0-1.4.hum1, poppler-qt6-devel 0:26.08.0-1.3.hum1, poppler-qt6-devel 0:26.08.0-1.4.hum1, poppler-utils 0:26.08.0-1.3.hum1, poppler-utils 0:26.08.0-1.4.hum1.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · fixed in Ubuntu 22.04 LTS (poppler 22.02.0-2ubuntu0.15)",
   "content_text": "Fixed versions: poppler 22.02.0-2ubuntu0.15.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · fixed in Ubuntu 24.04 LTS (poppler 24.02.0-1ubuntu9.11)",
   "content_text": "Fixed versions: poppler 24.02.0-1ubuntu9.11.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · fixed in Ubuntu 26.04 LTS (poppler 26.01.0-2ubuntu0.3)",
   "content_text": "Fixed versions: poppler 26.01.0-2ubuntu0.3.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107705/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107705/",
   "title": "CVE-2026-107705 · freedesktop poppler · fixed in Ubuntu 26.10 (poppler 26.07.0-2ubuntu1.1)",
   "content_text": "Fixed versions: poppler 26.07.0-2ubuntu1.1.",
   "date_published": "2026-10-08T19:51:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · disclosed",
   "content_text": "A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · fixed in Debian 14 (poppler 26.07.0-3)",
   "content_text": "Fixed versions: poppler 26.07.0-3.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · fixed in openSUSE Tumbleweed (poppler 26.09.0-3.1)",
   "content_text": "Fixed versions: poppler 26.09.0-3.1.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · fixed in Red Hat hummingbird 1 (poppler 0:26.08.0-1.2.hum1 and 9 more)",
   "content_text": "Fixed versions: poppler 0:26.08.0-1.2.hum1, poppler-cpp 0:26.08.0-1.2.hum1, poppler-cpp-devel 0:26.08.0-1.2.hum1, poppler-devel 0:26.08.0-1.2.hum1, poppler-glib 0:26.08.0-1.2.hum1, poppler-glib-devel 0:26.08.0-1.2.hum1, poppler-glib-doc 0:26.08.0-1.2.hum1, poppler-qt6 0:26.08.0-1.2.hum1, poppler-qt6-devel 0:26.08.0-1.2.hum1, poppler-utils 0:26.08.0-1.2.hum1.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · fixed in Ubuntu 22.04 LTS (poppler 22.02.0-2ubuntu0.14)",
   "content_text": "Fixed versions: poppler 22.02.0-2ubuntu0.14.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · fixed in Ubuntu 24.04 LTS (poppler 24.02.0-1ubuntu9.10)",
   "content_text": "Fixed versions: poppler 24.02.0-1ubuntu9.10.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102621/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102621/",
   "title": "CVE-2026-102621 · freedesktop poppler · fixed in Ubuntu 26.04 LTS (poppler 26.01.0-2ubuntu0.2)",
   "content_text": "Fixed versions: poppler 26.01.0-2ubuntu0.2.",
   "date_published": "2026-09-29T21:30:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · disclosed",
   "content_text": "A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.",
   "date_published": "2026-09-29T20:30:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · fixed in Debian 14 (poppler 26.07.0-3)",
   "content_text": "Fixed versions: poppler 26.07.0-3.",
   "date_published": "2026-09-29T20:30:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · fixed in openSUSE Tumbleweed (poppler 26.09.0-3.1)",
   "content_text": "Fixed versions: poppler 26.09.0-3.1.",
   "date_published": "2026-09-29T20:30:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · fixed in Red Hat hummingbird 1 (poppler 0:26.08.0-1.2.hum1 and 9 more)",
   "content_text": "Fixed versions: poppler 0:26.08.0-1.2.hum1, poppler-cpp 0:26.08.0-1.2.hum1, poppler-cpp-devel 0:26.08.0-1.2.hum1, poppler-devel 0:26.08.0-1.2.hum1, poppler-glib 0:26.08.0-1.2.hum1, poppler-glib-devel 0:26.08.0-1.2.hum1, poppler-glib-doc 0:26.08.0-1.2.hum1, poppler-qt6 0:26.08.0-1.2.hum1, poppler-qt6-devel 0:26.08.0-1.2.hum1, poppler-utils 0:26.08.0-1.2.hum1.",
   "date_published": "2026-09-29T20:30:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · fixed in Ubuntu 22.04 LTS (poppler 22.02.0-2ubuntu0.14)",
   "content_text": "Fixed versions: poppler 22.02.0-2ubuntu0.14.",
   "date_published": "2026-09-29T20:30:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · fixed in Ubuntu 24.04 LTS (poppler 24.02.0-1ubuntu9.10)",
   "content_text": "Fixed versions: poppler 24.02.0-1ubuntu9.10.",
   "date_published": "2026-09-29T20:30:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102620/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102620/",
   "title": "CVE-2026-102620 · freedesktop poppler · fixed in Ubuntu 26.04 LTS (poppler 26.01.0-2ubuntu0.2)",
   "content_text": "Fixed versions: poppler 26.01.0-2ubuntu0.2.",
   "date_published": "2026-09-29T20:30:15Z"
  }
 ]
}