Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
An update that solves one vulnerability can now be installed.. # Security update for poppler Announcement ID: SUSE-SU-2025:3898-1 Release Date: 2025-10-31T14:55:55Z Rating: moderate References: * bsc#1250908 Cross-References: * CVE-2025-43718 CVSS scores: * CVE-2025-43718 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2025-43718 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2025-43718 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43718 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3898=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-Poppler-0_18-22.01.0-150400.3.41.1 * libpoppler-glib8-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-22.01.0-150400.3.41.1 * libpoppler-glib8-22.01.0-150400.3.41.1 * poppler-tools-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-22.01.0-150400.3.41.1 * libpoppler-devel-22.01.0-150400.3.41.1 * poppler-qt5-debugsource-22.01.0-150400.3.41.1 * libpoppler-glib-devel-22.01.0-150400.3.41.1 * libpoppler117-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-3-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-devel-22.01.0-150400.3.41.1 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.41.1 *libpoppler-cpp0-22.01.0-150400.3.41.1 * libpoppler-qt6-3-22.01.0-150400.3.41.1 * poppler-tools-22.01.0-150400.3.41.1 * poppler-debugsource-22.01.0-150400.3.41.1 * poppler-qt6-debugsource-22.01.0-150400.3.41.1 * libpoppler-qt5-devel-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (x86_64) * libpoppler-glib8-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-22.01.0-150400.3.41.1 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libpoppler-glib8-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-22.01.0-150400.3.41.1 * libpoppler-glib8-64bit-22.01.0-150400.3.41.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43718.html * https://bugzilla.suse.com/show_bug.cgi?id=1250908 . This update addresses a moderate severity issue in poppler related to uncontrolled recursion in PDF files processing.. poppler security update, openSUSE patch, PDF processing fix, SUSE vulnerability management. . LinuxSecurity.com Team
* bsc#1250908 Cross-References: * CVE-2025-43718 . # Security update for poppler Announcement ID: SUSE-SU-2025:3898-1 Release Date: 2025-10-31T14:55:55Z Rating: moderate References: * bsc#1250908 Cross-References: * CVE-2025-43718 CVSS scores: * CVE-2025-43718 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2025-43718 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2025-43718 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43718 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3898=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-Poppler-0_18-22.01.0-150400.3.41.1 * libpoppler-glib8-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-22.01.0-150400.3.41.1 * libpoppler-glib8-22.01.0-150400.3.41.1 * poppler-tools-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-22.01.0-150400.3.41.1 * libpoppler-devel-22.01.0-150400.3.41.1 * poppler-qt5-debugsource-22.01.0-150400.3.41.1 * libpoppler-glib-devel-22.01.0-150400.3.41.1 * libpoppler117-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-3-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-devel-22.01.0-150400.3.41.1 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-22.01.0-150400.3.41.1 *libpoppler-qt6-3-22.01.0-150400.3.41.1 * poppler-tools-22.01.0-150400.3.41.1 * poppler-debugsource-22.01.0-150400.3.41.1 * poppler-qt6-debugsource-22.01.0-150400.3.41.1 * libpoppler-qt5-devel-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (x86_64) * libpoppler-glib8-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-22.01.0-150400.3.41.1 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libpoppler-glib8-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-22.01.0-150400.3.41.1 * libpoppler-glib8-64bit-22.01.0-150400.3.41.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43718.html * https://bugzilla.suse.com/show_bug.cgi?id=1250908 . A moderate security update for openSUSE addressing CVE-2025-43718 in poppler, preventing controlled recursions in PDF processing.. openSUSE Poppler Security Update, CVE-2025-43718 Patch, Linux Application Security. . LinuxSecurity.com Team
Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf-codegen Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf-codegen Summary : Code generator for rust-protobuf Description : Code generator for rust-protobuf. Includes a library to invoke programmatically (e. g. from `build.rs`) and `protoc-gen-rs` binary. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 21 2025 Fabio Valentini - 3.7.2-1 - Update to version 3.7.2; Fixes RHBZ#2080867 * Fri Jul 25 2025 Fedora Release Engineering - 2.28.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf-parse Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf-parse Summary : Parse .proto files Description : Parse `.proto` files. Files are parsed into a `protobuf::descriptor::FileDescriptorSet` object using either: * pure rust parser (no dependencies) * `protoc` binary (more reliable and compatible with Google's implementation). -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 3.7.2-1 - Initial import (#2397168) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su-c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf-support Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf-support Summary : Code supporting protobuf implementation Description : Code supporting protobuf implementation. None of code in this crate is public API. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 3.7.2-1 - Initial import (#2397167) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnfdocumentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-prometheus Product : Fedora 42 Version : 0.14.0 Release : 1.fc42 URL : https://crates.io/crates/prometheus Summary : Instrumentation library for Rust applications Description : Prometheus instrumentation library for Rust applications. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 0.14.0-1 - Update to version 0.14.0; Fixes RHBZ#2279084 * Fri Jul 25 2025 Fedora Release Engineering - 0.13.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : mirrorlist-server Product : Fedora 42 Version : 3.0.8 Release : 1.fc42 URL : https://github.com/adrianreber/mirrorlist-server Summary : Mirrorlist Server Description : The mirrorlist-server uses the data created by MirrorManager2 (https://github.com/fedora-infra/mirrormanager2) to answer client request for the "best" mirror. This implementation of the mirrorlist-server is written in Rust. The original version of the mirrorlist-server was part of the MirrorManager2 repository and it is implemented using Python. While moving from Python2 to Python3 one of the problems was that the data exchange format (Python Pickle) did not support running the MirrorManager2 backend with Python2 and the mirrorlist frontend with Python3. To have a Pickle independent data exchange format protobuf was introduced. The first try to use protobuf in the python mirrorlist implementation required a lot more memory than the Pickle based implementation (3.5GB instead of 1.1GB). That is one of the reasons a new mirrorlist-server implementation was needed. Another reason to rewrite the mirrorlist-server is its architecture. The Python based version requires the Apache HTTP server or something that can run the included wsgi. The wsgi talks over a socket to the actual mirrorlist-server. In Fedora's MirrorManager2 instance this runs in a container which runs behind HAProxy. This implementation in Rust directly uses a HTTP library to reduce the number of involvedcomponents. In addition to being simpler this implementation also requires less memory than the Python version. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 3.0.8-1 - Update to version 3.0.8; Fixes RHBZ#2379121 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf Summary : Rust implementation of Google protocol buffers Description : Rust implementation of Google protocol buffers. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 21 2025 Fabio Valentini - 3.7.2-1 - Update to version 3.7.2; Fixes RHBZ#2080866 * Fri Jul 25 2025 Fedora Release Engineering - 2.28.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade--advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.