[USN-7429-1] Linux kernel vulnerabilities
[USN-7428-1] Linux kernel vulnerabilities
[USN-7428-2] Linux kernel (FIPS) vulnerabilities
[USN-7429-2] Linux kernel (FIPS) vulnerabilities
[USN-7430-1] Dino vulnerability
[USN-7346-3] OpenSC vulnerabilities
[USN-7426-2] poppler vulnerabilities
[USN-7429-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7429-1
April 09, 2025
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Drivers core;
- HID subsystem;
- Network drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- File systems infrastructure;
- Ext4 file system;
- JFS file system;
- Network file system (NFS) client;
- Memory management;
- Network namespace;
- CAIF protocol;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Network traffic control;
(CVE-2025-21702, CVE-2024-53227, CVE-2024-46826, CVE-2024-49952,
CVE-2024-56600, CVE-2021-47235, CVE-2024-50265, CVE-2021-47119,
CVE-2024-53165, CVE-2021-47483, CVE-2024-50302, CVE-2024-56595,
CVE-2024-50167, CVE-2024-56658, CVE-2024-49948, CVE-2024-26921,
CVE-2021-47602, CVE-2024-26863, CVE-2021-47320, CVE-2025-21700,
CVE-2021-47122)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS
linux-image-4.4.0-1143-kvm 4.4.0-1143.154
Available with Ubuntu Pro
linux-image-4.4.0-1180-aws 4.4.0-1180.195
Available with Ubuntu Pro
linux-image-4.4.0-267-generic 4.4.0-267.301
Available with Ubuntu Pro
linux-image-4.4.0-267-lowlatency 4.4.0-267.301
Available with Ubuntu Pro
linux-image-aws 4.4.0.1180.184
Available with Ubuntu Pro
linux-image-generic 4.4.0.267.273
Available with Ubuntu Pro
linux-image-generic-lts-xenial 4.4.0.267.273
Available with Ubuntu Pro
linux-image-kvm 4.4.0.1143.140
Available with Ubuntu Pro
linux-image-lowlatency 4.4.0.267.273
Available with Ubuntu Pro
linux-image-lowlatency-lts-xenial 4.4.0.267.273
Available with Ubuntu Pro
linux-image-virtual 4.4.0.267.273
Available with Ubuntu Pro
linux-image-virtual-lts-xenial 4.4.0.267.273
Available with Ubuntu Pro
Ubuntu 14.04 LTS
linux-image-4.4.0-1142-aws 4.4.0-1142.148
Available with Ubuntu Pro
linux-image-4.4.0-267-generic 4.4.0-267.301~14.04.1
Available with Ubuntu Pro
linux-image-4.4.0-267-lowlatency 4.4.0-267.301~14.04.1
Available with Ubuntu Pro
linux-image-aws 4.4.0.1142.139
Available with Ubuntu Pro
linux-image-generic-lts-xenial 4.4.0.267.301~14.04.1
Available with Ubuntu Pro
linux-image-lowlatency-lts-xenial 4.4.0.267.301~14.04.1
Available with Ubuntu Pro
linux-image-virtual-lts-xenial 4.4.0.267.301~14.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7429-1
CVE-2021-47119, CVE-2021-47122, CVE-2021-47235, CVE-2021-47320,
CVE-2021-47483, CVE-2021-47602, CVE-2024-26863, CVE-2024-26921,
CVE-2024-46826, CVE-2024-49948, CVE-2024-49952, CVE-2024-50167,
CVE-2024-50265, CVE-2024-50302, CVE-2024-53165, CVE-2024-53227,
CVE-2024-56595, CVE-2024-56600, CVE-2024-56658, CVE-2025-21700,
CVE-2025-21702
[USN-7428-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7428-1
April 09, 2025
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- HID subsystem;
- Network drivers;
- Mellanox network drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- File systems infrastructure;
- Ext4 file system;
- JFS file system;
- IP tunnels definitions;
- Network namespace;
- BPF subsystem;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- Network traffic control;
(CVE-2024-56615, CVE-2024-56600, CVE-2025-21700, CVE-2024-56658,
CVE-2024-35960, CVE-2024-50265, CVE-2025-21702, CVE-2024-53227,
CVE-2024-53165, CVE-2024-50167, CVE-2024-26863, CVE-2024-35973,
CVE-2024-46826, CVE-2021-47119, CVE-2024-50302, CVE-2024-49952,
CVE-2021-47101, CVE-2024-49948, CVE-2024-56595)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
linux-image-4.15.0-1141-oracle 4.15.0-1141.152
Available with Ubuntu Pro
linux-image-4.15.0-1162-kvm 4.15.0-1162.167
Available with Ubuntu Pro
linux-image-4.15.0-1172-gcp 4.15.0-1172.189
Available with Ubuntu Pro
linux-image-4.15.0-1179-aws 4.15.0-1179.192
Available with Ubuntu Pro
linux-image-4.15.0-1187-azure 4.15.0-1187.202
Available with Ubuntu Pro
linux-image-4.15.0-236-generic 4.15.0-236.248
Available with Ubuntu Pro
linux-image-4.15.0-236-lowlatency 4.15.0-236.248
Available with Ubuntu Pro
linux-image-aws-lts-18.04 4.15.0.1179.177
Available with Ubuntu Pro
linux-image-azure-lts-18.04 4.15.0.1187.155
Available with Ubuntu Pro
linux-image-gcp-lts-18.04 4.15.0.1172.185
Available with Ubuntu Pro
linux-image-generic 4.15.0.236.220
Available with Ubuntu Pro
linux-image-kvm 4.15.0.1162.153
Available with Ubuntu Pro
linux-image-lowlatency 4.15.0.236.220
Available with Ubuntu Pro
linux-image-oracle-lts-18.04 4.15.0.1141.146
Available with Ubuntu Pro
linux-image-virtual 4.15.0.236.220
Available with Ubuntu Pro
Ubuntu 16.04 LTS
linux-image-4.15.0-1141-oracle 4.15.0-1141.152~16.04.1
Available with Ubuntu Pro
linux-image-4.15.0-1172-gcp 4.15.0-1172.189~16.04.1
Available with Ubuntu Pro
linux-image-4.15.0-1179-aws 4.15.0-1179.192~16.04.1
Available with Ubuntu Pro
linux-image-4.15.0-1187-azure 4.15.0-1187.202~16.04.1
Available with Ubuntu Pro
linux-image-4.15.0-236-generic 4.15.0-236.248~16.04.1
Available with Ubuntu Pro
linux-image-4.15.0-236-lowlatency 4.15.0-236.248~16.04.1
Available with Ubuntu Pro
linux-image-aws-hwe 4.15.0.1179.192~16.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0.1187.202~16.04.1
Available with Ubuntu Pro
linux-image-gcp 4.15.0.1172.189~16.04.1
Available with Ubuntu Pro
linux-image-generic-hwe-16.04 4.15.0.236.248~16.04.1
Available with Ubuntu Pro
linux-image-gke 4.15.0.1172.189~16.04.1
Available with Ubuntu Pro
linux-image-lowlatency-hwe-16.04 4.15.0.236.248~16.04.1
Available with Ubuntu Pro
linux-image-oem 4.15.0.236.248~16.04.1
Available with Ubuntu Pro
linux-image-oracle 4.15.0.1141.152~16.04.1
Available with Ubuntu Pro
linux-image-virtual-hwe-16.04 4.15.0.236.248~16.04.1
Available with Ubuntu Pro
Ubuntu 14.04 LTS
linux-image-4.15.0-1187-azure 4.15.0-1187.202~14.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0.1187.202~14.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7428-1
CVE-2021-47101, CVE-2021-47119, CVE-2022-23041, CVE-2024-26863,
CVE-2024-35960, CVE-2024-35973, CVE-2024-46826, CVE-2024-49948,
CVE-2024-49952, CVE-2024-50167, CVE-2024-50265, CVE-2024-50302,
CVE-2024-53165, CVE-2024-53227, CVE-2024-56595, CVE-2024-56600,
CVE-2024-56615, CVE-2024-56658, CVE-2025-21700, CVE-2025-21702
[USN-7428-2] Linux kernel (FIPS) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7428-2
April 09, 2025
linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-aws-fips: Linux kernel for Amazon Web Services (AWS) systems with FIPS
- linux-azure-fips: Linux kernel for Microsoft Azure Cloud systems with FIPS
- linux-fips: Linux kernel with FIPS
- linux-gcp-fips: Linux kernel for Google Cloud Platform (GCP) systems with
FIPS
Details:
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23041)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- HID subsystem;
- Network drivers;
- Mellanox network drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- File systems infrastructure;
- Ext4 file system;
- JFS file system;
- IP tunnels definitions;
- Network namespace;
- BPF subsystem;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- Network traffic control;
(CVE-2024-56615, CVE-2024-56600, CVE-2025-21700, CVE-2024-56658,
CVE-2024-35960, CVE-2024-50265, CVE-2025-21702, CVE-2024-53227,
CVE-2024-53165, CVE-2024-50167, CVE-2024-26863, CVE-2024-35973,
CVE-2024-46826, CVE-2021-47119, CVE-2024-50302, CVE-2024-49952,
CVE-2021-47101, CVE-2024-49948, CVE-2024-56595)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
linux-image-4.15.0-1134-fips 4.15.0-1134.145
Available with Ubuntu Pro
linux-image-4.15.0-2080-gcp-fips 4.15.0-2080.86
Available with Ubuntu Pro
linux-image-4.15.0-2096-azure-fips 4.15.0-2096.102
Available with Ubuntu Pro
linux-image-4.15.0-2117-aws-fips 4.15.0-2117.123
Available with Ubuntu Pro
linux-image-aws-fips 4.15.0.2117.111
Available with Ubuntu Pro
linux-image-azure-fips 4.15.0.2096.92
Available with Ubuntu Pro
linux-image-fips 4.15.0.1134.131
Available with Ubuntu Pro
linux-image-gcp-fips 4.15.0.2080.78
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7428-2
https://ubuntu.com/security/notices/USN-7428-1
CVE-2021-47101, CVE-2021-47119, CVE-2022-23041, CVE-2024-26863,
CVE-2024-35960, CVE-2024-35973, CVE-2024-46826, CVE-2024-49948,
CVE-2024-49952, CVE-2024-50167, CVE-2024-50265, CVE-2024-50302,
CVE-2024-53165, CVE-2024-53227, CVE-2024-56595, CVE-2024-56600,
CVE-2024-56615, CVE-2024-56658, CVE-2025-21700, CVE-2025-21702
[USN-7429-2] Linux kernel (FIPS) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7429-2
April 09, 2025
linux-fips vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-fips: Linux kernel with FIPS
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Drivers core;
- HID subsystem;
- Network drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- File systems infrastructure;
- Ext4 file system;
- JFS file system;
- Network file system (NFS) client;
- Memory management;
- Network namespace;
- CAIF protocol;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Network traffic control;
(CVE-2025-21702, CVE-2024-53227, CVE-2024-46826, CVE-2024-49952,
CVE-2024-56600, CVE-2021-47235, CVE-2024-50265, CVE-2021-47119,
CVE-2024-53165, CVE-2021-47483, CVE-2024-50302, CVE-2024-56595,
CVE-2024-50167, CVE-2024-56658, CVE-2024-49948, CVE-2024-26921,
CVE-2021-47602, CVE-2024-26863, CVE-2021-47320, CVE-2025-21700,
CVE-2021-47122)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS
linux-image-4.4.0-1112-fips 4.4.0-1112.119
Available with Ubuntu Pro
linux-image-fips 4.4.0.1112.113
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7429-2
https://ubuntu.com/security/notices/USN-7429-1
CVE-2021-47119, CVE-2021-47122, CVE-2021-47235, CVE-2021-47320,
CVE-2021-47483, CVE-2021-47602, CVE-2024-26863, CVE-2024-26921,
CVE-2024-46826, CVE-2024-49948, CVE-2024-49952, CVE-2024-50167,
CVE-2024-50265, CVE-2024-50302, CVE-2024-53165, CVE-2024-53227,
CVE-2024-56595, CVE-2024-56600, CVE-2024-56658, CVE-2025-21700,
CVE-2025-21702
[USN-7430-1] Dino vulnerability
==========================================================================
Ubuntu Security Notice USN-7430-1
April 09, 2025
dino-im vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Dino could be made to expose sensitive information over the
network.
Software Description:
- dino-im: modern XMPP client
Details:
Kim Alvefur discovered that Dino did not correctly sanitize certain
messages. A remote attacker could possibly use this issue to leak
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
dino-im 0.3.0-3ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
dino-im 0.1.0-1ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7430-1
CVE-2023-28686
[USN-7346-3] OpenSC vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7346-3
April 09, 2025
opensc vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
USN-7346-1 introduced a regression in OpenSC.
Software Description:
- opensc: Smart card utilities with support for PKCS#15 compatible cards
Details:
USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a
regression which broke smartcard based authentication. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a use-after-free vulnerability. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a stack buffer overflow. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2021-42782)
It was discovered that OpenSC did not correctly handle the length of
certain buffers, which could lead to a out-of-bounds access vulnerability.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)
Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero
length PIN. A physically proximate attacker could possibly use this issue
to gain unauthorized access to certain systems. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)
It was discovered that OpenSC did not correctly handle certain memory
operations. A physically proximate attacker could possibly use this issue
to compromise key generation, certificate loading and other card
management operations. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-40661)
Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a
timing side-channel and incorrectly handled RSA padding. An attacker
could possibly use this issue to recover sensitive information. This issue
only affected Ubuntu 22.04 LTS. (CVE-2023-5992)
Matteo Marini discovered that OpenSC did not properly manage memory due to
certain uninitialized variables. A physically proximate attacker could
possibly use this issue to gain unauthorized access to certain systems.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems.
(CVE-2024-45618, CVE-2024-45620)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2024-45619)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a buffer overflow. A physically
proximate attacker could possibly use this issue to compromise card
management operations during enrollment and modification. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-8443)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
opensc 0.20.0-3ubuntu0.1~esm4
Available with Ubuntu Pro
opensc-pkcs11 0.20.0-3ubuntu0.1~esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7346-3
https://ubuntu.com/security/notices/USN-7346-2
https://ubuntu.com/security/notices/USN-7346-1
CVE-2021-42780, CVE-2021-42782, CVE-2023-2977, CVE-2023-40660,
CVE-2023-40661, CVE-2024-45615, CVE-2024-45616, CVE-2024-45617,
CVE-2024-45618, CVE-2024-45620, CVE-2024-8443,
https://launchpad.net/bugs/2104948
[USN-7426-2] poppler vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7426-2
April 09, 2025
poppler vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
poppler could be made to crash if it opened a specially crafted PDF file.
Software Description:
- poppler: PDF rendering library
Details:
USN-7426-1 fixed several vulnerabilities in poppler. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that poppler incorrectly handled memory when opening
certain PDF files. An attacker could possibly use this issue to cause
poppler to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
libpoppler73 0.62.0-2ubuntu2.14+esm5
Available with Ubuntu Pro
poppler-utils 0.62.0-2ubuntu2.14+esm5
Available with Ubuntu Pro
Ubuntu 16.04 LTS
libpoppler58 0.41.0-0ubuntu1.16+esm6
Available with Ubuntu Pro
poppler-utils 0.41.0-0ubuntu1.16+esm6
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7426-2
https://ubuntu.com/security/notices/USN-7426-1
CVE-2025-32364, CVE-2025-32365
