CVE-2025-43903

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-43903
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*
History

06 Oct 2025, 16:37

Type Values Removed Values Added
First Time Freedesktop poppler
Freedesktop
Summary
  • (es) NSSCryptoSignBackend.cc en Poppler anterior a 25.04.0 no verifica las firmas adbe.pkcs7.sha1 en los documentos, lo que resulta en posibles falsificaciones de firmas.
References () https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669 - () https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669 - Patch
CPE cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*

18 Apr 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-18 21:15

Updated : 2025-10-06 16:37

NVD link : CVE-2025-43903

Mitre link : CVE-2025-43903

CVE.ORG link : CVE-2025-43903

JSON object : View

Products Affected

freedesktop

  • poppler
CWE
CWE-347

Improper Verification of Cryptographic Signature