feat: update poppler to 22.12.0-2+deb12u2

debian/changelog

@@ -1,43 +1,27 @@
-poppler (22.12.0-2+deb12u1deepin5) unstable; urgency=medium
+poppler (22.12.0-2+deb12u3) bookworm-security; urgency=high
 
-  * Rebuild with LTO enabled (dpkg vendor feature optimize/lto).
+  * Non-maintainer upload by the LTS Team.
+  * Fix CVE-2025-43903: Document signature forgery vulnerability (closes:
+    #1103545).
+  * Fix CVE-2025-50420: Denial of Service (infinite recursion) via crafted PDF
+    file (closes: #1110463).
+  * Fix CVE-2025-52886: Use-after-free due to reference count integer overflow
+    (closes: #1108784).
+  * Fix CVE-2024-6239: pdfinfo(1) crashes when using the -dests parameter with
+    a broken document (closes: #1074146).
 
- -- tunaichao <tunaichao@uniontech.com>  Fri, 11 Sep 2026 17:37:07 +0800
+ -- Guilhem Moulin <guilhem@debian.org>  Thu, 30 Jul 2026 22:29:04 +0200
 
-poppler (22.12.0-2+deb12u1deepin4) unstable; urgency=medium
+poppler (22.12.0-2+deb12u2) bookworm-security; urgency=high
 
-  * Fix CVE-2026-10118: Integer overflow in splash backend
-    tilingPatternFill
-
- -- lichenggang <lichenggang@deepin.org>  Wed, 10 Jun 2026 15:46:25 +0800
-
-poppler (22.12.0-2+deb12u1deepin3) unstable; urgency=medium
-
-  * Fix CVE-2025-43903: properly verify adbe.pkcs7.sha1 signatures
-    instead of only comparing digests, preventing signature forgeries
-  * Fix CVE-2025-50420: skip entries without Type or SubType in
-    markAnnotations to prevent infinite recursion via crafted PDF (DoS)
-  * Fix CVE-2025-52885: add duplicate entry check in
-    StructTreeRoot::parseNumberTreeNode to prevent use-after-free via
-    dangling pointers
-  * Fix CVE-2025-52886: add annotation count limits to prevent reference
-    count integer overflow (use-after-free)
-
- -- deepin-ci-robot <packages@deepin.org>  Sun, 17 May 2026 04:00:05 +0800
-
-poppler (22.12.0-2+deb12u1deepin2) unstable; urgency=medium
-
-  * Fix CVE-2025-43718: limit regex match length in
-    pdfConformanceFromString to prevent stack consumption (SIGSEGV) via
-    deeply nested PDF metadata
-
- -- deepin-ci-robot <packages@deepin.org>  Sun, 17 May 2026 03:59:41 +0800
-
-poppler (22.12.0-2+deb12u1deepin1) unstable; urgency=medium
-
-  * fix CVE-2024-6239 
+  * Non-maintainer upload by the Security Team.
+  * Make sure regex doesn't stack overflow by limiting it (CVE-2025-43718)
+    (Closes: #1117046)
+  * Check for duplicate entries (CVE-2025-52885) (Closes: #1117853)
+  * SplashOutputDev: Fix integer overflow in tilingPatternFill (CVE-2026-10118)
+    (Closes: #1138708)
 
- -- zengwei <zengwei1@uniontech.com>  Thu, 29 Jan 2026 13:43:35 +0800
+ -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 06 Jun 2026 15:00:14 +0200
 
 poppler (22.12.0-2+deb12u1) bookworm; urgency=medium
 

debian/patches/CVE-2024-6239.patch

@@ -1,25 +1,20 @@
-From 96d64f89778aead72b8ef1b465f7db2a31ff5763 Mon Sep 17 00:00:00 2001
-From: zengwei <zengwei1@uniontech.com>
-Date: Thu, 29 Jan 2026 11:35:54 +0800
-Subject: [PATCH] CVE-2024-6239
+From: Albert Astals Cid <aacid@kde.org>
+Date: Fri, 7 Jun 2024 00:54:55 +0200
+Subject: pdfinfo: Fix crash in broken documents when using -dests
 
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/0554731052d1a97745cb179ab0d45620589dd9c4
+Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2293594
+Bug: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1489
+Bug-Debian: https://bugs.debian.org/1074146
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-6239
 ---
  utils/pdfinfo.cc | 33 ++++++++++++++-------------------
  1 file changed, 14 insertions(+), 19 deletions(-)
 
 diff --git a/utils/pdfinfo.cc b/utils/pdfinfo.cc
-index 1f4ca79..0268299 100644
+index 1f4ca79..320600a 100644
 --- a/utils/pdfinfo.cc
 +++ b/utils/pdfinfo.cc
-@@ -15,7 +15,7 @@
- // under GPL version 2 or later
- //
- // Copyright (C) 2006 Dom Lachowicz <cinamod@hotmail.com>
--// Copyright (C) 2007-2010, 2012, 2016-2022 Albert Astals Cid <aacid@kde.org>
-+// Copyright (C) 2007-2010, 2012, 2016-2022, 2024 Albert Astals Cid <aacid@kde.org>
- // Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
- // Copyright (C) 2011 Vittal Aithal <vittal.aithal@cognidox.com>
- // Copyright (C) 2012, 2013, 2016-2018, 2021 Adrian Johnson <ajohnson@redneon.com>
 @@ -112,11 +112,11 @@ static const ArgDesc argDesc[] = { { "-f", argInt, &firstPage, 0, "first page to
                                     { "-?", argFlag, &printHelp, 0, "print usage information" },
                                     {} };
@@ -46,18 +41,19 @@ index 1f4ca79..0268299 100644
  static void printUCS4String(const Unicode *u, int len, const UnicodeMap *uMap)
  {
      char buf[8];
-@@ -295,10 +300,6 @@ static void printStruct(const StructElement *element, unsigned indent)
+@@ -295,11 +300,6 @@ static void printStruct(const StructElement *element, unsigned indent)
      }
  }
 
 -struct GooStringCompare
 -{
 -    bool operator()(GooString *lhs, GooString *rhs) const { return lhs->cmp(const_cast<GooString *>(rhs)) < 0; }
 -};
- 
+-
  static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
  {
-@@ -370,29 +371,25 @@ static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
+     GooString s;
+@@ -370,29 +370,25 @@ static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
 
  static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
  {
@@ -93,16 +89,14 @@ index 1f4ca79..0268299 100644
          }
      }
 
-@@ -406,9 +403,7 @@ static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
+@@ -406,9 +402,8 @@ static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
                      printf("%4d ", i);
                      printLinkDest(it.second);
                      printf(" \"");
 -                    printTextString(it.first, uMap);
++                    printStdTextString(it.first, uMap);
                      printf("\"\n");
 -                    delete it.first;
                  }
              }
          }
--- 
-2.20.1
-

debian/patches/CVE-2025-43903.patch

@@ -1,6 +1,26 @@
+From: Juraj Šarinay <juraj@sarinay.com>
+Date: Thu, 6 Mar 2025 02:02:56 +0100
+Subject: Properly verify adbe.pkcs7.sha1 signatures.
+
+For signatures with non-empty encapsulated content
+(typically adbe.pkcs7.sha1), we only compared hash values and
+never actually checked SignatureValue within SignerInfo.
+The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
+made trivial signature forgeries possible. Fix this by calling
+NSS_CMSSignerInfo_Verify() after the hash values compare equal.
+
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669
+Bug-Debian: https://bugs.debian.org/1103545
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-43903
+---
+ poppler/SignatureHandler.cc | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/poppler/SignatureHandler.cc b/poppler/SignatureHandler.cc
+index e0579ca..60d2271 100644
 --- a/poppler/SignatureHandler.cc
 +++ b/poppler/SignatureHandler.cc
-@@ -977,16 +977,23 @@
+@@ -977,16 +977,20 @@ SignatureValidationStatus SignatureHandler::validateSignature()
            This means it's not a detached type signature
            so the digest is contained in SignedData->contentInfo
          */
@@ -14,12 +34,9 @@
          }
 
 -    } else if (NSS_CMSSignerInfo_Verify(CMSSignerInfo, &digest, nullptr) != SECSuccess) {
-+        HASHContext *innerHashContext = initHashContext();
++        auto innerHashContext = HASH_Create(getHashAlgorithm());
 +        HASH_Update(innerHashContext, content_info_data->data, content_info_data->len);
-+        PORT_Free(digest_buffer);
-+        digest_buffer = (unsigned char *)PORT_Alloc(hash_length);
-+        unsigned int inner_result_len = 0;
-+        HASH_End(innerHashContext, digest_buffer, &inner_result_len, hash_length);
++        HASH_End(innerHashContext, digest_buffer, &result_len, hash_length);
 +        HASH_Destroy(innerHashContext);
 +        digest.data = digest_buffer;
 +        digest.len = hash_length;

debian/patches/CVE-2025-50420.patch

@@ -1,6 +1,25 @@
+From: Sune Vuorela <sune@vuorela.dk>
+Date: Tue, 29 Jul 2025 14:14:00 +0200
+Subject: Fix crash in pdfseparate
+
+Don't continue recursing in PDFDoc::mark* if things looks a bit weirder
+than expected
+
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/a7025904e3330dd6cf95f3664ef6fc77034cc5e1
+Bug: https://github.com/Landw-hub/CVE-2025-50420
+Bug: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1613
+Bug: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1849
+Bug-Debian: https://bugs.debian.org/1110463
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-50420
+---
+ poppler/PDFDoc.cc | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
+index 036786c..d8ccebb 100644
 --- a/poppler/PDFDoc.cc
 +++ b/poppler/PDFDoc.cc
-@@ -1816,6 +1816,15 @@
+@@ -1816,6 +1816,15 @@ bool PDFDoc::markAnnotations(Object *annotsObj, XRef *xRef, XRef *countRef, unsi
              if (obj1.isDict()) {
                  Dict *dict = obj1.getDict();
                  Object type = dict->lookup("Type");

debian/patches/CVE-2025-52886.patch

@@ -1,29 +1,38 @@
+From: Sune Vuorela <sune@vuorela.dk>
+Date: Tue, 3 Jun 2025 00:35:19 +0200
+Subject: Limit ammount of annots per document/page
+
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
+Bug: https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
+Bug: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
+Bug: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
+Bug-Debian: https://bugs.debian.org/1108784
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-52886
+---
+ poppler/Annot.cc |  4 ++++
+ poppler/Page.cc  | 16 ++++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/poppler/Annot.cc b/poppler/Annot.cc
+index 5716ea5..b091af1 100644
 --- a/poppler/Annot.cc
 +++ b/poppler/Annot.cc
-@@ -7482,6 +7482,10 @@
+@@ -7482,6 +7482,10 @@ Annots::Annots(PDFDoc *docA, int page, Object *annotsObj)
                  const Object &obj2 = annotsObj->arrayGetNF(i);
                  annot = createAnnot(std::move(obj1), &obj2);
                  if (annot) {
-+                    if (annot->getRefCnt() > 100000) {
++                    if (annot->refCnt > 100000) {
 +                        error(errSyntaxError, -1, "Annotations likely malformed. Too many references. Stopping processing annots on page {0:d}", page);
 +                        break;
 +                    }
                      if (annot->isOk()) {
                          annot->setPage(page, false); // Don't change /P
                          appendAnnot(annot);
---- a/poppler/Annot.h
-+++ b/poppler/Annot.h
-@@ -718,6 +718,7 @@
-
-     void incRefCnt();
-     void decRefCnt();
-+    int getRefCnt() const { return refCnt; }
-
-     virtual void draw(Gfx *gfx, bool printing);
-     // Get the resource dict of the appearance stream
+diff --git a/poppler/Page.cc b/poppler/Page.cc
+index c256d39..46cbbb7 100644
 --- a/poppler/Page.cc
 +++ b/poppler/Page.cc
-@@ -289,6 +289,18 @@
+@@ -289,6 +289,22 @@ Page::Page(PDFDoc *docA, int numA, Object &&pageDict, Ref pageRefA, PageAttrs *a
          goto err2;
      }
 
@@ -32,9 +41,13 @@
 +        goto err2;
 +    }
 +    if (annotsObj.isRef()) {
-+        Object resolvedAnnotsObj = annotsObj.fetch(doc->getXRef());
-+        if (resolvedAnnotsObj.isArray() && resolvedAnnotsObj.arrayGetLength() > 10000) {
-+            error(errSyntaxError, -1, "Page annotations object (page {0:d}) is likely malformed. Too big: ({1:d})", num, resolvedAnnotsObj.arrayGetLength());
++        auto resolvedObj = getAnnotsObject();
++        if (resolvedObj.isArray() && resolvedObj.arrayGetLength() > 10000) {
++            error(errSyntaxError, -1, "Page annotations object (page {0:d}) is likely malformed. Too big: ({1:d})", num, resolvedObj.arrayGetLength());
++            goto err2;
++        }
++        if (!resolvedObj.isArray() && !resolvedObj.isNull()) {
++            error(errSyntaxError, -1, "Page annotations object (page {0:d}) is wrong type ({1:s})", num, resolvedObj.getTypeName());
 +            goto err2;
 +        }
 +    }

debian/patches/Check-for-duplicate-entries.patch

@@ -0,0 +1,29 @@
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Wed, 3 Sep 2025 14:36:54 +0100
+Subject: Check for duplicate entries
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/4ce27cc826bf90cc8dbbd8a8c87bd913cccd7ec0
+Bug-Debian: https://bugs.debian.org/1117853
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-52885
+
+---
+ poppler/StructTreeRoot.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/poppler/StructTreeRoot.cc b/poppler/StructTreeRoot.cc
+index eb46147bd1cd..fc7bf4ceb05a 100644
+--- a/poppler/StructTreeRoot.cc
++++ b/poppler/StructTreeRoot.cc
+@@ -136,6 +136,10 @@ void StructTreeRoot::parseNumberTreeNode(const Dict &node)
+                 }
+                 int keyVal = key.getInt();
+                 std::vector<Parent> &vec = parentTree[keyVal];
++                if (!vec.empty()) {
++                    error(errSyntaxError, -1, "Nums item at position {0:d} is a duplicate entry for key {1:d}", i, keyVal);
++                    continue;
++                }
+
+                 Object valueArray = nums.arrayGet(i + 1);
+                 if (valueArray.isArray()) {
+-- 
+2.53.0
+

debian/patches/Make-sure-regex-doesn-t-stack-overflow-by-limiting-i.patch

@@ -0,0 +1,24 @@
+From: Albert Astals Cid <aacid@kde.org>
+Date: Wed, 26 Mar 2025 11:26:32 +0100
+Subject: Make sure regex doesn't stack overflow by limiting it
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408
+Bug-Debian: https://bugs.debian.org/1117046
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-43718
+
+Happens with very long pdfsubver strings when compiled with
+-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto
+---
+ poppler/PDFDoc.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -480,7 +480,7 @@ static PDFSubtypePart pdfPartFromString(
+
+ static PDFSubtypeConformance pdfConformanceFromString(const std::string &pdfsubver)
+ {
+-    const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]+)");
++    const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]{1,3})");
+     std::smatch match;
+     PDFSubtypeConformance pdfConf = subtypeConfNone;
+