CVE-2025-43903

EUVD-2025-11892
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.28%
Affected Products (NVD)
VendorProductVersion
freedesktoppoppler
𝑥
< 25.04.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
poppler
bookworm
vulnerable
bookworm (security)
22.12.0-2+deb12u3
fixed
bullseye
vulnerable
bullseye (security)
20.09.0-3.1+deb11u3
fixed
forky
26.07.0-2
fixed
sid
26.07.0-2
fixed
trixie
25.03.0-5+deb13u4
fixed
trixie (security)
25.03.0-5+deb13u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
poppler
bionic
Fixed 0.62.0-2ubuntu2.14+esm6
released
focal
Fixed 0.86.1-0ubuntu1.7
released
jammy
Fixed 22.02.0-2ubuntu0.8
released
noble
Fixed 24.02.0-1ubuntu9.4
released
oracular
Fixed 24.08.0-1ubuntu0.3
released
plucky
Fixed 25.03.0-3ubuntu1
released
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpoppler-cpp0
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
libpoppler-devel
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
libpoppler-glib-devel
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
libpoppler-glib8
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
libpoppler135
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
poppler-tools
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
typelib-1_0-Poppler-0_18
suse enterprise desktop 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise desktop 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP6
24.03.0-150600.3.13.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.13.1
fixed
Common Weakness Enumeration
References
https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669