NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade popplerNo solution exists | May 15, 2025 | Apr 18, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 18, 2025 |
| Suse | — | Upgrade libpoppler-glib8Upgrade libpoppler-develUpgrade libpoppler-glib-develUpgrade libpoppler-cpp0Upgrade libpoppler135-32bitUpgrade libpoppler-qt5-develUpgrade libpoppler-qt5-1-32bitUpgrade libpoppler-cpp0-32bitUpgrade libpoppler-glib8-32bitUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-qt6-develUpgrade libpoppler-qt5-1Upgrade libpoppler-qt6-3Upgrade poppler-toolsUpgrade libpoppler135 | Dec 5, 2025 | May 2, 2025 |
| Ubuntu | — | Upgrade libpoppler134Upgrade libpoppler118Upgrade libpoppler73 (Ubuntu Pro)Upgrade poppler-utilsUpgrade poppler-utils (Ubuntu Pro)Upgrade libpoppler97Upgrade libpoppler140Upgrade libpoppler147 | May 1, 2025 | Apr 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub