Repository navigation
fix(cve): CVE-2026-93314 - [PATCH] FoFiTrueType::mapCodeToGID: Improve b*12 overflow check - #12
Merged
Merged
Conversation
…e b*12 overflow check CVE: CVE-2026-93314 (medium) - FoFiTrueType::mapCodeToGID: Improve b*12 overflow check Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ed2a5538cf0a8d3ff908191eda9b73f91a5f952a Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
|
TAG Bot TAG: 22.12.0-2+deb12u3deepin1 |
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
…odeTableSeg CVE: CVE-2026-93313 (medium) - 整数溢出漏洞在 JBIG2Stream::readCodeTableSeg 函数中 Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/eb87cf711563894649bd0c365baa479401dc6d51 适配目标代码库：该版本 readCodeTableSeg 返回类型为 void，故将上游的 return false 改为 return。 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-93312 (medium) - 修复 poppler/JBIG2Stream.cc 中 pageBitmap 为 nullptr 时的崩溃问题 Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…length limit CVE: CVE-2026-107705 (high) - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…oPath CVE: CVE-2026-102621 - A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8 适配目标代码库：该版本 SplashError 为 typedef int，故将上游的 SplashError::Generic 改为 splashErrGeneric。 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…ype::cvtSfnts CVE: CVE-2026-102620 - A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d 适配目标代码库：添加 goo/GooCheckedOps.h 头文件包含，解决 checkedAdd 函数调用声明未包含问题。 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
|
/test all |
|
/integrate |
|
AutoIntegrationPr Bot |
Zeno-sole
force-pushed
the
fix-cve/CVE-2026-93314
branch
from
October 15, 2026 13:55
dde0258 to
3f9d12f
Compare
|
已按 master（22.12.0-2+deb12u3）rebase 解决冲突，并修复两处编译错误。 1. 六个 CVE 在 22.12.0-2+deb12u3 中的状态：均未修复，全部保留
2. 冲突原因与解决
3. 修复两处编译错误（原 PR 无法构建）
4. 验证
|
|
/integrate |
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-93314 (medium) - FoFiTrueType::mapCodeToGID: Improve b*12 overflow check
Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ed2a5538cf0a8d3ff908191eda9b73f91a5f952a
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-93313 - 兼容性适配修改：将 return false 改为 return，适配目标代码库 void 返回类型
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-93312 (medium) - 修复 poppler/JBIG2Stream.cc 中 pageBitmap 为 nullptr 时的崩溃问题
Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067.patch
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-107705 (high) - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs
Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398.patch
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-102621 (unknown) - A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment.
Upstream: https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-102620 - 兼容性适配：添加 goo/GooCheckedOps.h 头文件包含，解决 checkedAdd 函数调用声明未包含问题
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b