R1Ck99

A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.

**Name of the Vulnerable Software and Affected Versions** Freedesktop Poppler version 26.07.0 **Description** A remote integer overflow occurs in the `SampledFunction::SampledFunction()` function within the `poppler/Function.cc` file of the `SampledFunction` component. This issue is triggered by the manipulation of the `BitsPerSample` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `SampledFunction::SampledFunction()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Freedesktop Poppler version 26.07.0 **Description** A remote flaw exists in the `JBIG2Stream::rewind()` function within the poppler/JBIG2Stream.cc file. This issue leads to a null pointer dereference, which occurs when the software attempts to read from a memory address that is null, typically resulting in a program crash. **Recommendations** Update to version 26.08.0.

**Name of the Vulnerable Software and Affected Versions** Freedesktop Poppler version 26.07.0 **Description** A remote attack can trigger an integer overflow in the `JBIG2Stream::readCodeTableSeg()` function within the poppler/JBIG2Stream.cc file. An integer overflow occurs when an arithmetic operation results in a value that exceeds the maximum size of the integer type used to store it. **Recommendations** Deploy patch eb87cf711563894649bd0c365baa479401dc6d51 for version 26.07.0.

**Name of the Vulnerable Software and Affected Versions** Freedesktop Poppler version 26.07.0 **Description** A remote attack is possible due to an integer overflow in the `FoFiTrueType::mapCodeToGID()` function within the fofi/FoFiTrueType.cc file. This issue occurs when the `segCnt` argument is manipulated. **Recommendations** Apply patch ed2a5538cf0a8d3ff908191eda9b73f91a5f952a for version 26.07.0.