Public bug reported:
A new release of poppler is available for merging from Debian.
Ubuntu: 26.07.0-2ubuntu1
Debian Unstable: 26.07.0-3
### New Debian Changes ###
poppler (26.07.0-3) unstable; urgency=high
* Team upload
[ Marc Deslauriers ]
* SECURITY UPDATE: overflow in FoFiTrueType::cvtSfnts
- debian/patches/CVE-2026-102620.patch: Fix integer overflow in
FoFiTrueType::cvtSfnts in fofi/FoFiTrueType.cc.
- CVE-2026-102620 (Closes: #1149697)
* SECURITY UPDATE: overflow in SplashClip::clipToPath
- debian/patches/CVE-2026-102621.patch: Fix integer overflow in
SplashClip::clipToPath in splash/SplashClip.cc.
- CVE-2026-102621 (Closes: #1149698)
* SECURITY UPDATE: null pointer deref issue
- debian/patches/CVE-2026-93312.patch: Fix nullptr + number in
poppler/JBIG2Stream.cc.
- CVE-2026-93312
* SECURITY UPDATE: overflow in JBIG2Stream::readCodeTableSeg
- debian/patches/CVE-2026-93313.patch: Fix integer overflow in
JBIG2Stream::readCodeTableSeg in poppler/JBIG2Stream.cc.
- CVE-2026-93313
* SECURITY UPDATE: overflow in FoFiTrueType::mapCodeToGID
- debian/patches/CVE-2026-93314.patch: FoFiTrueType::mapCodeToGID: Improve
b*12 overflow check in fofi/FoFiTrueType.cc.
- CVE-2026-93314 (Closes: #1148266)
-- Jeremy Bícha <[email protected]> Tue, 06 Oct 2026 17:58:35 +0200
### Old Ubuntu Delta ###
poppler (26.07.0-2ubuntu1) stonking; urgency=medium
* SECURITY UPDATE: overflow in FoFiTrueType::cvtSfnts
- debian/patches/CVE-2026-102620.patch: Fix integer overflow in
FoFiTrueType::cvtSfnts in fofi/FoFiTrueType.cc.
- CVE-2026-102620
* SECURITY UPDATE: overflow in SplashClip::clipToPath
- debian/patches/CVE-2026-102621.patch: Fix integer overflow in
SplashClip::clipToPath in splash/SplashClip.cc.
- CVE-2026-102621
* SECURITY UPDATE: null pointer deref issue
- debian/patches/CVE-2026-93312.patch: Fix nullptr + number in
poppler/JBIG2Stream.cc.
- CVE-2026-93312
* SECURITY UPDATE: overflow in JBIG2Stream::readCodeTableSeg
- debian/patches/CVE-2026-93313.patch: Fix integer overflow in
JBIG2Stream::readCodeTableSeg in poppler/JBIG2Stream.cc.
- CVE-2026-93313
* SECURITY UPDATE: overflow in FoFiTrueType::mapCodeToGID
- debian/patches/CVE-2026-93314.patch: FoFiTrueType::mapCodeToGID: Improve
b*12 overflow check in fofi/FoFiTrueType.cc.
- CVE-2026-93314
-- Marc Deslauriers <[email protected]> Tue, 06 Oct 2026
10:21:23 -0400
** Affects: poppler (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: poppler (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: poppler (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171246
Title:
Merge poppler 26.07.0-3 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/2171246/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
