NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade poppler | May 15, 2025 | Apr 18, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 18, 2025 |
| Suse | — | Upgrade libpoppler-qt5-1Upgrade libpoppler-qt6-3Upgrade poppler-toolsUpgrade libpoppler135Upgrade libpoppler-cpp0Upgrade libpoppler-glib8-32bitUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-qt5-1-32bitUpgrade libpoppler-qt6-develUpgrade libpoppler-glib8Upgrade libpoppler-glib-develUpgrade libpoppler-cpp0-32bitUpgrade libpoppler-qt5-develUpgrade libpoppler135-32bitUpgrade libpoppler-devel | Dec 5, 2025 | May 2, 2025 |
| Ubuntu | — | Upgrade libpoppler118Upgrade libpoppler134Upgrade poppler-utils (Ubuntu Pro)Upgrade libpoppler73 (Ubuntu Pro)Upgrade poppler-utilsUpgrade libpoppler147Upgrade libpoppler140Upgrade libpoppler97 | May 1, 2025 | Apr 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub