-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 30 Jul 2026 22:29:04 +0200 Source: poppler Architecture: source Version: 22.12.0-2+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Debian freedesktop.org maintainers <pkg-freedesktop-maintainers@lists.alioth.debian.org> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 1074146 1103545 1108784 1110463 Changes: poppler (22.12.0-2+deb12u3) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * Fix CVE-2025-43903: Document signature forgery vulnerability (closes: #1103545). * Fix CVE-2025-50420: Denial of Service (infinite recursion) via crafted PDF file (closes: #1110463). * Fix CVE-2025-52886: Use-after-free due to reference count integer overflow (closes: #1108784). * Fix CVE-2024-6239: pdfinfo(1) crashes when using the -dests parameter with a broken document (closes: #1074146). Checksums-Sha1: 8f89a6cd66f0679a7b58248988c5b1b09be781d7 3486 poppler_22.12.0-2+deb12u3.dsc 9a26f06c38a0b31f6e98f2df3c8991a4415ba487 43580 poppler_22.12.0-2+deb12u3.debian.tar.xz 82ab19bad8bb8b01fe02a4d29dd02030549a7437 15185 poppler_22.12.0-2+deb12u3_source.buildinfo Checksums-Sha256: 528b0d841a807314275f4031a51ab38810d22b7adeb73cdd1b1d8e3e059b3152 3486 poppler_22.12.0-2+deb12u3.dsc 2028e5351ad7c0e4c1166776468d810dd5bcb981dbcdc91189277cfcfec614a2 43580 poppler_22.12.0-2+deb12u3.debian.tar.xz 1c66674f75686e8cc9cf114b3a2c617e4423c844392d5e1837992eeaa2411774 15185 poppler_22.12.0-2+deb12u3_source.buildinfo Files: fb41dff64cac66bd751c489ca1ba2c1b 3486 devel optional poppler_22.12.0-2+deb12u3.dsc 7e92fea88c049a855ef2e407078f699f 43580 devel optional poppler_22.12.0-2+deb12u3.debian.tar.xz ddb51a3dd45311c0c1cd549cd636af40 15185 devel optional poppler_22.12.0-2+deb12u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmps9koACgkQ05pJnDwh pVIymQ//dENyKG2TEYQTMgfE76Aw9zcckME/NR7Jr6VsvRh96q2AV7+ohs5gCe8u E+/G6HlVA7FP7iexwhuF2NSZ2W3iC9BkJ4Nfx4Sz/DxsnDZkqbYku0AfhWxbkAfI ikdNLTQSV9LilDeAtR2Beme/YOPgOTNQDxq9zIQlI0nDlaIlr4+EhNpWdkhvcGVD b+t1+IkLaZFASCTrF4vP9ZY125n4Wnaa4Vq7qejWaHEU6TMrd/kmrRF4sDJzFgai nQiELkJSvRGjz6rqfo8TL1UWf84kxGVy0wa/r9/HxzEBgMUdHceS27782YFKV8nK uo3xqZiPu4e2Xtljev/6xdpDokJ3LGiW3DVk5V49rQG5oOpsH+h6Bjamf6MJpZQI 4gknUgxHa/JvZQVaC9Ud7m15q2TSSKDoYFZ0UWf4Z1Jc29v1WX8QjqBoErA5WRaP CCvkVVZMhb523inmgRCR7tjJiTgH3hldcQdyAvowgW6K2DPIHbTOVoNcIqVX9go2 3PXRUlu6+ABvOxWKfMv7nKQiyN6L/s0zLJeksBjcbgssa4TO7GC3Y7buthxEzLC7 spgk3i0j8Lbam+UZh5N5mRKS2/W/I2iWAStuD5YwU7WadRrSeu/POmHB9KANw3gZ BexK3te6AqPi9gpT55q1Hv/8UYskcG9Ghl6DkTILC8a6jhJVhv0= =kVB8 -----END PGP SIGNATURE-----
