Your message dated Thu, 11 Jun 2026 20:47:32 +0000
with message-id <[email protected]>
and subject line Bug#1138708: fixed in poppler 25.03.0-5+deb13u3
has caused the Debian Bug report #1138708,
regarding poppler: CVE-2026-10118
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138708: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138708
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: poppler
Version: 26.01.0-4
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for poppler.
CVE-2026-10118[0]:
| A flaw was found in Poppler's Splash backend. A remote attacker
| could exploit this vulnerability by crafting a malicious PDF file
| that, when rendered, triggers an integer overflow in the
| `tilingPatternFill` function. This overflow leads to an undersized
| heap memory allocation, allowing a subsequent out-of-bounds write.
| Successful exploitation could result in arbitrary code execution,
| information disclosure, or denial of service within the context of
| the application processing the PDF.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-10118
https://www.cve.org/CVERecord?id=CVE-2026-10118
[1] https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715
[2]
https://gitlab.freedesktop.org/poppler/poppler/-/commit/8352264766652b98336e92359a70b3161a9ab97a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: poppler
Source-Version: 25.03.0-5+deb13u3
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
poppler, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated poppler package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 06 Jun 2026 11:07:43 +0200
Source: poppler
Architecture: source
Version: 25.03.0-5+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Debian freedesktop.org maintainers
<[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1117046 1117853 1138708
Changes:
poppler (25.03.0-5+deb13u3) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* SplashOutputDev: Fix integer overflow in tilingPatternFill (CVE-2026-10118)
(Closes: #1138708)
* Make sure regex doesn't stack overflow by limiting it (CVE-2025-43718)
(Closes: #1117046)
* Check for duplicate entries (CVE-2025-52885) (Closes: #1117853)
Checksums-Sha1:
8b17e8eeb60c2fb37a25ce36fc7bcfc095678a13 4121 poppler_25.03.0-5+deb13u3.dsc
ee5041be2a6bd6b6e5627776c7c82b788e238f58 1954516 poppler_25.03.0.orig.tar.xz
cb74cff2ea515391ee267c81a926b0ece4a14991 43964
poppler_25.03.0-5+deb13u3.debian.tar.xz
4f393b77eeecfaebbf22a1d38ac3d75654911d6b 6752
poppler_25.03.0-5+deb13u3_source.buildinfo
Checksums-Sha256:
4c867dedb90253a5693832f2187ee00cc4db1c997c7573f2289e4048480ff1f9 4121
poppler_25.03.0-5+deb13u3.dsc
97da4ff88517a6bbd729529f195f85c8d7a0c3bb4a3d57cb0c685cbb052fe837 1954516
poppler_25.03.0.orig.tar.xz
1234f92a2cbf5dafc80f34b51e98d1d79011fd51072744109c0f5c2aff32c658 43964
poppler_25.03.0-5+deb13u3.debian.tar.xz
d6145e8aefdd9df8b648e5117de0b55571d15fa89a8b2718351c0354b3789c4a 6752
poppler_25.03.0-5+deb13u3_source.buildinfo
Files:
58612a17225657930e99712d758f4a68 4121 devel optional
poppler_25.03.0-5+deb13u3.dsc
21bb345c070ab16d7cd3bafcd513cc02 1954516 devel optional
poppler_25.03.0.orig.tar.xz
561810f6047d557cd24c78cfd2f69f96 43964 devel optional
poppler_25.03.0-5+deb13u3.debian.tar.xz
4109a65dfb6a5ee70c2fe7d801a0846e 6752 devel optional
poppler_25.03.0-5+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmokO0dfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89Ebc4P/3j31hUaSEt4mDqRErLcG+N/ZGz90An6
7j8gu1FUIpFFLLVXLJNgyHBNdNrpwrwB/KTrS5zBKY1i6YdNDql3C7YnunlPLANM
DMnsQYejHklGBQoMbzP4PK0FIrLjHt/KkqyNr9JbDPZ7hCS6jJJfVpHT8EtCLlfQ
WwUWcuwpIzUuauLjg3FeQHFAlWLhSQZDeghHbiQwkzb4O6E0RdEHTG39wlByfq4+
IrnwIzeowbtM01OfoTILJ/wK9HAsspNAfROXnVJLZ6W1REYXOQ0Ys0+ZBAiJLUOB
vcOfRm/IcNBeKOaLHnJuc9F/355xacMFpZrgdCsPaDer1GhOv712h6g8+nrWwpN7
8UMcJmcUJDBS9E7Z/z5R28UVtxk/7FsA9Jgg4aO4At70MTSr+kLCF/tSjLIlxLMY
e0v82K+YC407ZsvliUIh4QA7nvr92mBDYQ1vX+zsvqkon8bS/nSmAd5OtUzvQJgW
QWq19XF79kvqX1JemXN2YN5/dHL1zTh7hAzyuUzkAWiRVq7gedd7xR0YhGoFAct0
k794rTiaSXlkdafGUxrVv3AQ+2CufoArs4iB+SUOAXey94rG0mHDYlzUx4uIFirM
AWGJnzixcSf6Ca0fi71WPOuHfky2ATmc6Cr0uS4u9BVUKkGCyE3HAEenIEuvPSth
9kf//BntPfoH
=bOAU
-----END PGP SIGNATURE-----
pgpiRmzVoILAe.pgp
Description: PGP signature
--- End Message ---
