NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade poppler | May 15, 2025 | Apr 18, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 18, 2025 |
| Suse | — | Upgrade libpoppler-qt5-1-32bitUpgrade libpoppler-qt5-develUpgrade libpoppler-glib-develUpgrade libpoppler-glib8-32bitUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-cpp0-32bitUpgrade libpoppler-develUpgrade libpoppler-qt6-develUpgrade libpoppler-glib8Upgrade libpoppler135-32bitUpgrade libpoppler-cpp0Upgrade libpoppler-qt5-1Upgrade libpoppler-qt6-3Upgrade poppler-toolsUpgrade libpoppler135 | Dec 5, 2025 | May 2, 2025 |
| Ubuntu | — | Upgrade libpoppler97Upgrade libpoppler147Upgrade libpoppler140Upgrade poppler-utilsUpgrade libpoppler118Upgrade poppler-utils (Ubuntu Pro)Upgrade libpoppler73 (Ubuntu Pro)Upgrade libpoppler134 | May 1, 2025 | Apr 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub