Merge poppler (25.03.0-5+deb13u4) import into refs/heads/workingbranch

DateInfo: Fix timeToStringWithFormat buffer length

Origin: upstream, https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1824.patch
Applied-Upstream: 25.06.0, https://gitlab.freedesktop.org/poppler/poppler/-/commit/55169105e121d5fbb7c50e2c744d750de5d0a7de
Bug: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1596
Bug-Debian: https://bugs.debian.org/1127146
Reviewed-By: John Scott <jscott@posteo.net>
Last-Update: 2026-07-01

strftime places a NULL-terminated string in the buffer, so the std::string
buffer needs to be resized to not include the terminator character
(or anything after it).

Without this fix, modification dates in altered PDF documents (such as when
adding a digital signature) are not truncated properly, instead padding
the date with a null byte and extra spaces until the end of the buffer is
reached. This bad syntax compromises the ability to verify the signature
with other applications, but the Poppler signatory has no indication of this.

Gbp-Pq: Name malformed-moddate.patch

Check for duplicate entries

Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/4ce27cc826bf90cc8dbbd8a8c87bd913cccd7ec0
Bug-Debian: https://bugs.debian.org/1117853
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-52885

Gbp-Pq: Name Check-for-duplicate-entries.patch

Make sure regex doesn't stack overflow by limiting it

Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408
Bug-Debian: https://bugs.debian.org/1117046
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-43718

Happens with very long pdfsubver strings when compiled with
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto

Gbp-Pq: Name Make-sure-regex-doesn-t-stack-overflow-by-limiting-i.patch

SplashOutputDev: Fix integer overflow in tilingPatternFill

Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/8352264766652b98336e92359a70b3161a9ab97a
Bug-Debian: https://bugs.debian.org/1138708
Bug: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-10118

Use checkedMultiply() to check integer multiplication of surface size
and number of repetitions to avoid integer overflow and possible memory issues.

Fixes: #1715
Gbp-Pq: Name SplashOutputDev-Fix-integer-overflow-in-tilingPatter.patch

[PATCH] Fix crash in pdfseparate

Don't continue recursing in PDFDoc::mark* if things looks a bit weirder
than expected

Gbp-Pq: Name CVE-2025-50420.patch

CVE-2025-52886

Backport of:

Backport of:

From ac36affcc8486de38e8905a8d6547a3464ff46e5 Mon Sep 17 00:00:00 2001
From: Sune Vuorela <sune@vuorela.dk>
Date: Tue, 3 Jun 2025 00:35:19 +0200
Subject: [PATCH] Limit ammount of annots per document/page

Gbp-Pq: Name CVE-2025-52886.patch

Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch

[PATCH] Move isOk check to inside JBIG2Bitmap::combine

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32365.patch

[PATCH] PSStack::roll: Protect against doing int = -INT_MIN

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32364.patch

poppler (25.03.0-5+deb13u4) trixie; urgency=medium

  * Team upload
  * Fix creation of ill-formed PDF document signatures (Poppler issue #1596)
    - fixes "Invalid signature time when signing a PDF" (Closes: #1127146)
    Signatures made with previous versions of Poppler may not be recognized
    by other applications as valid.

[dgit import unpatched poppler 25.03.0-5+deb13u4]

Import poppler_25.03.0-5+deb13u4.debian.tar.xz

[dgit import tarball poppler 25.03.0-5+deb13u4 poppler_25.03.0-5+deb13u4.debian.tar.xz]

Merge poppler (25.03.0-5+deb13u3) import into refs/heads/workingbranch

Check for duplicate entries

Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/4ce27cc826bf90cc8dbbd8a8c87bd913cccd7ec0
Bug-Debian: https://bugs.debian.org/1117853
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-52885

Gbp-Pq: Name Check-for-duplicate-entries.patch

Make sure regex doesn't stack overflow by limiting it

Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408
Bug-Debian: https://bugs.debian.org/1117046
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-43718

Happens with very long pdfsubver strings when compiled with
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto

Gbp-Pq: Name Make-sure-regex-doesn-t-stack-overflow-by-limiting-i.patch

SplashOutputDev: Fix integer overflow in tilingPatternFill

Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/8352264766652b98336e92359a70b3161a9ab97a
Bug-Debian: https://bugs.debian.org/1138708
Bug: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-10118

Use checkedMultiply() to check integer multiplication of surface size
and number of repetitions to avoid integer overflow and possible memory issues.

Fixes: #1715
Gbp-Pq: Name SplashOutputDev-Fix-integer-overflow-in-tilingPatter.patch

[PATCH] Fix crash in pdfseparate

Don't continue recursing in PDFDoc::mark* if things looks a bit weirder
than expected

Gbp-Pq: Name CVE-2025-50420.patch

CVE-2025-52886

Backport of:

Backport of:

From ac36affcc8486de38e8905a8d6547a3464ff46e5 Mon Sep 17 00:00:00 2001
From: Sune Vuorela <sune@vuorela.dk>
Date: Tue, 3 Jun 2025 00:35:19 +0200
Subject: [PATCH] Limit ammount of annots per document/page

Gbp-Pq: Name CVE-2025-52886.patch

Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch

[PATCH] Move isOk check to inside JBIG2Bitmap::combine

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32365.patch

[PATCH] PSStack::roll: Protect against doing int = -INT_MIN

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32364.patch

poppler (25.03.0-5+deb13u3) trixie-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * SplashOutputDev: Fix integer overflow in tilingPatternFill (CVE-2026-10118)
    (Closes: #1138708)
  * Make sure regex doesn't stack overflow by limiting it (CVE-2025-43718)
    (Closes: #1117046)
  * Check for duplicate entries (CVE-2025-52885) (Closes: #1117853)

[dgit import unpatched poppler 25.03.0-5+deb13u3]

Import poppler_25.03.0-5+deb13u3.debian.tar.xz

[dgit import tarball poppler 25.03.0-5+deb13u3 poppler_25.03.0-5+deb13u3.debian.tar.xz]

Merge poppler (25.03.0-5+deb13u2) import into refs/heads/workingbranch

[PATCH] Fix crash in pdfseparate

Don't continue recursing in PDFDoc::mark* if things looks a bit weirder
than expected

Gbp-Pq: Name CVE-2025-50420.patch

CVE-2025-52886

Backport of:

Backport of:

From ac36affcc8486de38e8905a8d6547a3464ff46e5 Mon Sep 17 00:00:00 2001
From: Sune Vuorela <sune@vuorela.dk>
Date: Tue, 3 Jun 2025 00:35:19 +0200
Subject: [PATCH] Limit ammount of annots per document/page

Gbp-Pq: Name CVE-2025-52886.patch

Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch

[PATCH] Move isOk check to inside JBIG2Bitmap::combine

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32365.patch

[PATCH] PSStack::roll: Protect against doing int = -INT_MIN

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32364.patch

poppler (25.03.0-5+deb13u2) trixie; urgency=high

  [ Leonidas Da Silva Barbosa ]
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2025-50420.patch: don't continue
      recursing in PDFDoc in poppler/PDFDoc.cc.
    - CVE-2025-50420 (Closes: #1110463)

[dgit import unpatched poppler 25.03.0-5+deb13u2]

Import poppler_25.03.0-5+deb13u2.debian.tar.xz

[dgit import tarball poppler 25.03.0-5+deb13u2 poppler_25.03.0-5+deb13u2.debian.tar.xz]

Merge poppler (25.03.0-5) import into refs/heads/workingbranch

CVE-2025-52886

Backport of:

Backport of:

From ac36affcc8486de38e8905a8d6547a3464ff46e5 Mon Sep 17 00:00:00 2001
From: Sune Vuorela <sune@vuorela.dk>
Date: Tue, 3 Jun 2025 00:35:19 +0200
Subject: [PATCH] Limit ammount of annots per document/page

Gbp-Pq: Name CVE-2025-52886.patch

Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch

[PATCH] Move isOk check to inside JBIG2Bitmap::combine

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32365.patch

[PATCH] PSStack::roll: Protect against doing int = -INT_MIN

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32364.patch

poppler (25.03.0-5) unstable; urgency=high

  [ Marc Deslauriers ]
  * SECURITY UPDATE: DoS via reference count overflow
    - debian/patches/CVE-2025-52886.patch: limit amount of annots per
      document/page in poppler/Annot.cc, poppler/Page.cc.
    - CVE-2025-52886 (Closes: #1108784)

[dgit import unpatched poppler 25.03.0-5]

Import poppler_25.03.0-5.debian.tar.xz

[dgit import tarball poppler 25.03.0-5 poppler_25.03.0-5.debian.tar.xz]

Merge poppler (25.03.0-4) import into refs/heads/workingbranch

Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch

[PATCH] Move isOk check to inside JBIG2Bitmap::combine

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32365.patch

[PATCH] PSStack::roll: Protect against doing int = -INT_MIN

Origin: upstream 25.04

Gbp-Pq: Name CVE-2025-32364.patch

poppler (25.03.0-4) unstable; urgency=high

  * Team upload
  * SECURITY UPDATE: Properly verify abde.pkcs7.sha1 signatures
    - Cherry-pick upstream fix for the
      NSSSignatureVerification::validateSignature function
      in NSSCryptoSignBackend.cc
    - CVE-2025-43903 (Closes: #1103545)

[dgit import unpatched poppler 25.03.0-4]

Import poppler_25.03.0-4.debian.tar.xz

[dgit import tarball poppler 25.03.0-4 poppler_25.03.0-4.debian.tar.xz]

Import poppler_25.03.0.orig.tar.xz

[dgit import orig poppler_25.03.0.orig.tar.xz]

poppler (24.08.0-2) unstable; urgency=medium

  * Team upload
  * Release to unstable

[dgit import unpatched poppler 24.08.0-2]

Import poppler_24.08.0-2.debian.tar.xz

[dgit import tarball poppler 24.08.0-2 poppler_24.08.0-2.debian.tar.xz]

Import poppler_24.08.0.orig.tar.xz

[dgit import orig poppler_24.08.0.orig.tar.xz]