-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 31 Jul 2026 01:24:52 +0200 Source: poppler Architecture: source Version: 20.09.0-3.1+deb11u3 Distribution: bullseye-security Urgency: high Maintainer: Debian freedesktop.org maintainers <pkg-freedesktop-maintainers@lists.alioth.debian.org> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1103545 1108784 1110463 1117046 1117853 1138708 Changes: poppler (20.09.0-3.1+deb11u3) bullseye-security; urgency=high . * Non-maintainer upload by the LTS Team. * Fix CVE-2025-43718: SIGSEGV via deeply nested structures within the metadata (closes: #1117046). * Fix CVE-2025-43903: Document signature forgery vulnerability (closes: #1103545). * Fix CVE-2025-50420: Denial of Service (infinite recursion) via crafted PDF file (closes: #1110463). * Fix CVE-2025-52885: Use-after-free vulnerability within the StructTreeRoot class (closes: #1117853). * Fix CVE-2025-52886: Use-after-free vulnerability due to reference count integer overflow (closes: #1108784). * Fix CVE-2026-10118: Heap buffer overflow in tilingPatternFill via integer overflow (closes: #1138708). Checksums-Sha1: dd7fbeea838f6c7c4e44e9b95d075b67705b27f7 3341 poppler_20.09.0-3.1+deb11u3.dsc 6ddce8fabce47d8c35ad602cb3ca2cfcef423dd9 1642932 poppler_20.09.0.orig.tar.xz a7d2c6819a58d602ef0444847dbe2f5dea50c90e 44128 poppler_20.09.0-3.1+deb11u3.debian.tar.xz 356842aad6913d4b249ebeca4030357df4e6ff3a 9669 poppler_20.09.0-3.1+deb11u3_source.buildinfo Checksums-Sha256: 65447d8367dff541ef17e360a675c0b75cf9a24b076afd091f31b8daa8a9dc45 3341 poppler_20.09.0-3.1+deb11u3.dsc 4ed6eb5ddc4c37f2435c9d78ff9c7c4036455aea3507d1ce8400070aab745363 1642932 poppler_20.09.0.orig.tar.xz 066ed7407043c2036d81daa037852318a2997e77227ac2a317060d8256be7c15 44128 poppler_20.09.0-3.1+deb11u3.debian.tar.xz 981ac23b3a232f585fdd3838b2e626a5ff8a5a061cfda6c939f3927df4f308ef 9669 poppler_20.09.0-3.1+deb11u3_source.buildinfo Files: 853a8c512b3740fc445bf35166b80e08 3341 devel optional poppler_20.09.0-3.1+deb11u3.dsc 969328317ed60213f78b3502b074b72e 1642932 devel optional poppler_20.09.0.orig.tar.xz c4fd06bfeb8a661ca0ee298144b1dbf1 44128 devel optional poppler_20.09.0-3.1+deb11u3.debian.tar.xz 1484e583d940adfec3b3672825b52c9a 9669 devel optional poppler_20.09.0-3.1+deb11u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmps9jMACgkQ05pJnDwh pVKEuQ/+MTrcxahLVjoDdLZAGVS06QcWxvT06mGNNCYnhcQykmolExvYURnjF3IU /sB99/xNYZCtUDV5rkAhCYubOC0UFSSn6Ci4A/qs0fdJU9gYa855meO0zjq0TIqq C6ghFxKWbMuwoMX8Jo+MJ2Uni4BY71k+KLL8ecP+IAJUTFBn+vuUN1UdaBTzUTNb 8W1f32POZRkMVoa1KuPdyJ/FnuhOUBybsY7naamEvfMKAtNgQS+o3BNNsnrsNfOM gACHm4JZxy9Qfv3+Jy7+cUtGwR0ye2ndSm7GaWiQbeUi6zkkVdVZrMgqJkb75tMY bLrRaXdcXzb8/FGOVqSC8EeiZcebt5y2pesF/lTdFqVCTgkasXBswzHDncOVmpQw cFkFdE33Emt4bOSkiC/3j8wP5HkZ9GAQ9oFt9MgC16FnjMW83xYmOpyQpVHP/tDJ 3PGZh5cwrZ7GokDwXCwUoHOFfF858DiLJio43SNQbCNeA4GA0/8vFNHnFJOfCyYe ySuW1ULSo4dNum5UxEluIBTU1Zn6tZbDMgDaDj7BeukpT6ezIASWVs9IecJmTzh4 q4cI6UaYUXcZzUkMLbSQCdbVtm1auBBT/krRBcRjpZ4ZV4NvUpiEkbqjBjd6hgy7 rzeolRarFdOybfIQ+MXr1knwz8R/VZudTc0MXOQFybzXFwL1lOo= =m52L -----END PGP SIGNATURE-----
