UnratedFix available
Fix CVE(s): CVE-2020-23804, CVE-2025-32365
Type: advisorySources: OSV
* SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine() (JBIG2Stream.cc) via a crafted JBIG2 stream, from a misplaced isOk check - debian/patches/CVE-2025-32365.patch: add the isOk() guard at the top of JBIG2Bitmap::combine() so every caller is protected against out-of-bounds reads on a not-OK bitmap (upstream commit 1f151565, adapted to poppler 0.62 GBool/Guint) - CVE-2025-32365 * SECURITY UPDATE: uncontrolled recursion / stack overflow in the XRefStm chain parser (XRef.cc) via a crafted PDF, causing denial of service - debian/patches/CVE-2020-23804.patch: cap the XRefStm chain at 4096 entries in XRef::readXRefTable() to stop the readXRef/readXRefTable recursion from exhausting the stack on crafted PDFs (upstream commit ec8a43c8) - CVE-2020-23804
- Products
- gir1.2-poppler-0.18, libpoppler-cpp-dev, libpoppler-cpp0v5, libpoppler-dev, libpoppler-glib-dev, libpoppler-glib-doc, libpoppler-glib8, libpoppler-private-dev, libpoppler-qt5-1, libpoppler-qt5-dev, libpoppler73, poppler-utils
- Affected versions
- Not specified
- Fixed versions
- 0.62.0-2ubuntu2.14+tuxcare.els2
- CVEs
- CVE-2020-23804, CVE-2025-32365
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:41 UTC · Revision 1
Source evidence
Fix CVE(s): CVE-2020-23804, CVE-2025-32365
core-osv · Original sourcePublished 26 Aug 2026, 08:26 UTC
* SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine() (JBIG2Stream.cc) via a crafted JBIG2 stream, from a misplaced isOk check - debian/patches/CVE-2025-32365.patch: add the isOk() guard at the top of JBIG2Bitmap::combine() so every caller is protected against out-of-bounds reads on a not-OK bitmap (upstream commit 1f151565, adapted to poppler 0.62 GBool/Guint) - CVE-2025-32365 * SECURITY UPDATE: uncontrolled recursion / stack overflow in the XRefStm chain parser (XRef.cc) via a crafted PDF, causing denial of service - debian/patches/CVE-2020-23804.patch: cap the XRefStm chain at 4096 entries in XRef::readXRefTable() to stop the readXRef/readXRefTable recursion from exhausting the stack on crafted PDFs (upstream commit ec8a43c8) - CVE-2020-23804
osv:CLSA-2026-1787732795
gir1.2-poppler-0.18
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-cpp-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-cpp0v5
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-glib-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-glib-doc
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-glib8
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-private-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-qt5-1
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler-qt5-dev
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
libpoppler73
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
poppler-utils
Fixed versions: 0.62.0-2ubuntu2.14+tuxcare.els2
Complete source record
{
"id": "1bc71190d2ba7242b1569398d83c3744a8f03ec8d57fc87808b665639a0a2991",
"url": "https://osv.dev/vulnerability/CLSA-2026-1787732795",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2020-23804, CVE-2025-32365",
"summary": "* SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine() (JBIG2Stream.cc) via a crafted JBIG2 stream, from a misplaced isOk check - debian/patches/CVE-2025-32365.patch: add the isOk() guard at the top of JBIG2Bitmap::combine() so every caller is protected against out-of-bounds reads on a not-OK bitmap (upstream commit 1f151565, adapted to poppler 0.62 GBool/Guint) - CVE-2025-32365 * SECURITY UPDATE: uncontrolled recursion / stack overflow in the XRefStm chain parser (XRef.cc) via a crafted PDF, causing denial of service - debian/patches/CVE-2020-23804.patch: cap the XRefStm chain at 4096 entries in XRef::readXRefTable() to stop the readXRef/readXRefTable recursion from exhausting the stack on crafted PDFs (upstream commit ec8a43c8) - CVE-2020-23804",
"evidence": "osv:CLSA-2026-1787732795",
"products": [
{
"name": {
"value": "gir1.2-poppler-0.18",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-cpp-dev",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-cpp0v5",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-dev",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-glib-dev",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-glib-doc",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-glib8",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-private-dev",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-qt5-1",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler-qt5-dev",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libpoppler73",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler-utils",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.62.0-2ubuntu2.14+tuxcare.els2",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1787732795",
"aliases": [
"CLSA-2026-1787732795"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "gir1.2-poppler-0.18",
"purl": "pkg:deb/tuxcare/gir1.2-poppler-0.18?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-cpp-dev",
"purl": "pkg:deb/tuxcare/libpoppler-cpp-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-cpp0v5",
"purl": "pkg:deb/tuxcare/libpoppler-cpp0v5?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-dev",
"purl": "pkg:deb/tuxcare/libpoppler-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-glib-dev",
"purl": "pkg:deb/tuxcare/libpoppler-glib-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-glib-doc",
"purl": "pkg:deb/tuxcare/libpoppler-glib-doc?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-glib8",
"purl": "pkg:deb/tuxcare/libpoppler-glib8?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-private-dev",
"purl": "pkg:deb/tuxcare/libpoppler-private-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-qt5-1",
"purl": "pkg:deb/tuxcare/libpoppler-qt5-1?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler-qt5-dev",
"purl": "pkg:deb/tuxcare/libpoppler-qt5-dev?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "libpoppler73",
"purl": "pkg:deb/tuxcare/libpoppler73?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.62.0-2ubuntu2.14+tuxcare.els2"
}
]
}
],
"package": {
"name": "poppler-utils",
"purl": "pkg:deb/tuxcare/poppler-utils?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787732795.json"
}
}
],
"modified": "2026-10-26T09:32:03.774012903Z",
"provider": "osv",
"upstream": [
"CVE-2020-23804",
"CVE-2025-32365"
],
"references": [
"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787732795.html",
"https://nvd.nist.gov/vuln/detail/CVE-2020-23804",
"https://nvd.nist.gov/vuln/detail/CVE-2025-32365"
]
},
"related_cves": [
{
"value": "CVE-2020-23804",
"evidence": "/upstream"
},
{
"value": "CVE-2025-32365",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449551,
"published_at": "2026-08-26T08:26:47+00:00"
}