Accepting request 1319631 from X11:common:Factory

OBS-URL: https://build.opensuse.org/request/show/1319631
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/poppler?expand=0&rev=219

poppler-25.08.0.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:425ed4d4515a093bdcdbbaac6876f20617451edc710df6a4fd6c45dd67eb418d
-size 1975316

poppler-25.08.0.tar.xz.sig

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEyiYsbIPeTS+yijMqOmpNuDnqptcFAmiPlqMACgkQOmpNuDnq
-pteR9xAAmaaN4eJjIh5lMZufOQGFTcyCd8261lpC7GS3zuKhUU5pJ4JgM9P11QDG
-vbdP8CyQtwypx4gwTk8E9AYab2yaerOInJhOfxPqM6g62Ci8FbdZai2cS4FxbYiW
-ZVi1aVOeXAuY0O3Ff5sXRD1pV8sNVINLXtuNVD0C6JVP5fdXKOAL2dX2CsCC5cjN
-GtLhs9ibiX8zyPjTgOS7Hg//iGiXuUjY+IC/W6vnaU/97pf7qhDm7CstqAaUO447
-0fJkMZSeVwdSUmcHpW4F5Om3PiAY+9DRs8SlonaMrdHruBV67f03xU2ZAnJQ4615
-JpJG5iYADCNZ9QjQgtZZ2d5pkyHWfPyjjfjjFnRnfvGYWQJZsLV1bcXNo+NvjCAK
-DTnyLPp15NKXighBXGKB5ffa4hPbhiC+WpQ++2k83bkELlIrFw61xib2L4CpNCl4
-ZcJ0kNBmgKMmS4dIyu2FB5a2BJMGY8JUvdo834U167ne8ZrdlTFIXWsF/sScIVhs
-3u7xuLuhpOEXIBApH7riicX87utjPNv56c9tEn2YqRf6VxgyYjX7Yn1rQSvN39sW
-PdA1Wx6dkB9sXkoePniC6C6rEbrSen37TalWGR7MwGzrPxAx2VQGr7xrl7CiZ7zf
-hDaNn7/NMiLOV/MfyJ1gppxXN5t9vbaPcrwPmfyUTaa+4HwBVs8=
-=6g5w
------END PGP SIGNATURE-----

poppler-25.09.1.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0c1091d01d3dd1664a13816861e812d02b29201e96665454b81b52d261fad658
+size 1980980

poppler-25.09.1.tar.xz.sig

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEyiYsbIPeTS+yijMqOmpNuDnqptcFAmi4qVQACgkQOmpNuDnq
+ptdMyhAAhGRDeBK/m0RX2Yv5lAKbYITg9ZvKiPV+1C4h/YPldD5txrnL27MrZLYF
+Iz5Xcn2S0TFt9cZ3HWZOEvBZiEKjPZ7qoCbgGBgz1CCjky8yt8W1MAhTTIGaz2dU
+q6K0UxFnGbi/gUW1voO1gAaM0DS8t33Z27XB+6UsTkYxt72tpD8B48KItgUODfEP
+nNfTxdxwNOM2vULIzdIUAQhpOmqmi9CJZcdUg6qpKbm0nixqLq603wKoPFK8Cq9B
+47apBbKK/9u4jLXLN639owXGGFerCNQNDcYHpZROWztQWlqJN7wfmyx/blFm1rX1
+BYbMrYsmf+S/J31DMlEVuwAftCL6BRW6p2nSeRzbozjW7uJkUuRjlxGxnGBIKVbu
+FuzP9h93OSEQxdZgEOXQ4szDzJ2zDEuqY2HKESaH+Id8VOgvAM1xsFwB5cqPL14v
+DQT7pygNrrd0vLF/jbvJU+bBS2KBVbX3wsGUTss8NzuRqQ41s+AnNeX/uTnAdX6t
+XmSH7LKTQ/fNkN2hSQ3RrpRON0+UOpFjb0rSAVvFJU+T7yA7liUa0G0szOfR6Z5T
+v9nInykc/9LBaL6eb78CLWUMRL0V/n8hbrFosFmd/VR7qF8uKf9mnuiTtMWgqH5N
+AY+8JvRSTJZU6SU3dtULfpetu8xmwAZt3dahjZYN8eV/bGof+Y4=
+=ji4F
+-----END PGP SIGNATURE-----

poppler-CVE-2025-52885.patch

@@ -0,0 +1,27 @@
+From 4ce27cc826bf90cc8dbbd8a8c87bd913cccd7ec0 Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Wed, 3 Sep 2025 14:36:54 +0100
+Subject: [PATCH] Check for duplicate entries
+
+---
+ poppler/StructTreeRoot.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/poppler/StructTreeRoot.cc b/poppler/StructTreeRoot.cc
+index eb46147bd1..fc7bf4ceb0 100644
+--- a/poppler/StructTreeRoot.cc
++++ b/poppler/StructTreeRoot.cc
+@@ -136,6 +136,10 @@ void StructTreeRoot::parseNumberTreeNode(const Dict &node)
+                 }
+                 int keyVal = key.getInt();
+                 std::vector<Parent> &vec = parentTree[keyVal];
++                if (!vec.empty()) {
++                    error(errSyntaxError, -1, "Nums item at position {0:d} is a duplicate entry for key {1:d}", i, keyVal);
++                    continue;
++                }
+ 
+                 Object valueArray = nums.arrayGet(i + 1);
+                 if (valueArray.isArray()) {
+-- 
+GitLab
+

poppler.changes

@@ -1,3 +1,36 @@
+-------------------------------------------------------------------
+Sat Nov 22 21:23:26 CET 2025 - Stanislav Brabec <sbrabec@suse.com>
+
+- Remove unused BuildRequires: update-desktop-files.
+
+-------------------------------------------------------------------
+Tue Oct 14 09:19:40 UTC 2025 - pgajdos@suse.com
+
+- security update
+- added patches
+  CVE-2025-52885 [bsc#1251940], raw pointers can lead to dangling pointers when the vector is resized
+  * poppler-CVE-2025-52885.patch
+
+-------------------------------------------------------------------
+Wed Sep 10 08:05:24 UTC 2025 - pgajdos@suse.com
+
+- version update to 25.09.1:
+  * Speed improvements when reusing the same document with different output devices
+  * Speed improvements when reading from network file systems
+  * Internal code improvements
+  * Fix generated .pc files when using old gpgme
+- version update to 25.09.0:
+  * Speed improvements when reusing the same document with different output devices
+  * Speed improvements when reading from network file systems
+  * Internal code improvements
+  * Fix crashes in malformed documents
+  * fix ODR issue with enum
+  * pdftohtml: Fix text positioning. (Regressed in 25.07.0)
+  * Better pkgconfig support for static builds
+- deleted patches
+  * reduce-boost-required-version.patch (upstreamed)
+  * reduce-libtiff-required-version.patch (upstreamed)
+
 -------------------------------------------------------------------
 Tue Aug  5 09:57:10 UTC 2025 - pgajdos@suse.com
 

poppler.spec

@@ -24,7 +24,7 @@
 %endif
 # Actual version of poppler-data:
 %define poppler_data_version 0.4.11
-%define poppler_sover 152
+%define poppler_sover 153
 %define poppler_cpp_sover 2
 %define poppler_glib_sover 8
 %define poppler_qt5_sover 1
@@ -32,7 +32,7 @@
 %define poppler_api 0.18
 %define poppler_apipkg 0_18
 Name:           poppler%{?psuffix}
-Version:        25.08.0
+Version:        25.09.1
 Release:        0
 Summary:        PDF Rendering Library
 License:        GPL-2.0-only OR GPL-3.0-only
@@ -42,8 +42,8 @@ Source:         %{url}/%{sname}-%{version}.tar.xz
 Source1:        %{url}/%{sname}-%{version}.tar.xz.sig
 Source90:       poppler.keyring
 Source99:       baselibs.conf
-Patch0:         reduce-boost-required-version.patch
-Patch1:         reduce-libtiff-required-version.patch
+# CVE-2025-52885 [bsc#1251940], raw pointers can lead to dangling pointers when the vector is resized
+Patch0:         poppler-CVE-2025-52885.patch
 
 BuildRequires:  cmake >= 3.10
 BuildRequires:  gtk-doc
@@ -51,7 +51,6 @@ BuildRequires:  libboost_headers-devel >= 1.66
 BuildRequires:  libgpgmepp-devel >= 1.19
 BuildRequires:  openjpeg2
 BuildRequires:  pkgconfig
-BuildRequires:  update-desktop-files
 BuildRequires:  pkgconfig(cairo) >= 1.10.0
 BuildRequires:  pkgconfig(cairo-ft)
 BuildRequires:  pkgconfig(cairo-pdf)

reduce-boost-required-version.patch

@@ -1,13 +0,0 @@
-Index: poppler-25.06.0/CMakeLists.txt
-===================================================================
---- poppler-25.06.0.orig/CMakeLists.txt
-+++ poppler-25.06.0/CMakeLists.txt
-@@ -232,7 +232,7 @@ add_definitions(-DQT_NO_KEYWORDS)
- # Check for Cairo rendering backend
- macro_optional_find_package(Cairo ${CAIRO_VERSION})
- 
--find_package(Boost 1.74.0 CONFIG)
-+find_package(Boost 1.66.0 CONFIG)
- if(Boost_FOUND)
-   set(USE_BOOST_HEADERS ON)
- elseif(ENABLE_BOOST)

reduce-libtiff-required-version.patch

@@ -1,13 +0,0 @@
-Index: poppler-25.06.0/CMakeLists.txt
-===================================================================
---- poppler-25.06.0.orig/CMakeLists.txt
-+++ poppler-25.06.0/CMakeLists.txt
-@@ -169,7 +169,7 @@ endmacro()
- 
- find_soft_mandatory_package(ENABLE_NSS3 NSS3 3.68)
- find_soft_mandatory_package(ENABLE_GPGME Gpgmepp 1.19)
--find_soft_mandatory_package(ENABLE_LIBTIFF TIFF 4.3)
-+find_soft_mandatory_package(ENABLE_LIBTIFF TIFF 4.0.9)
- 
- macro_optional_find_package(JPEG)
- macro_optional_find_package(PNG)