Ubuntu alert USN-8837-1 (pdfminer)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8837-1] pdfminer vulnerabilities
Date:
             
 
Tue, 29 Sep 2026 16:07:39 +0000
Message-ID:
             
 
<E1xBaMl-0004x7-AP@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8837-1
September 28, 2026

pdfminer vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

pdfminer could be made to run programs as your login if it opened a
specially crafted file.

Software Description:
- pdfminer: PDF parser and analyser

Details:

It was discovered that pdfminer did not safely parse specially crafted
PDF files. An attacker could possibly use these issues to execute
arbitrary code. (CVE-2025-64512, CVE-2025-70559)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  python3-pdfminer                20221105+dfsg-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  python3-pdfminer                20220319+dfsg-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  python3-pdfminer                20191020+dfsg-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  python-pdfminer                 20140328+dfsg-1ubuntu0.18.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  python-pdfminer                 20140328+dfsg-1ubuntu0.16.04.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8837-1
  CVE-2025-64512, CVE-2025-70559


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq6hKYACgkQcpJm3tlz
hgHmAhAA16bjhIphrCR+xj2OFjWNrl0y+VRHWtquyOImWPWN2LYLGk67kWG/nm/2
W8Tc9dDEtfjml4hwPevxFyo0p0w3zGyw9oJtoiH+0g+X7kwWAeNH4UUabQw9egN2
8FjbBChbh/RTf//TlUGCLxMUjghfjUqZqr1zpFcJFSai2KwQaj4mXbihE7DKpd/D
PYVMycwBW3P7d2J/7gjsr4mGnzHXNmDbGFbzIZJV+sB12AsY6xjWztM9bZyeML0c
IDWTpe+15fj5sv65L7kth6zM0rOd6fo5f7s8gV3QTxEDuXasWtB3/XQVmg491SeK
oDaQ8s2cElj/vPWLQhaPfJq0bQQ/KQKqadLrXUeUTYuyaKLeruYIFdmMDNPaMpck
JSA3Ulwa7kw2QHE6/YX5yL9wD4UiAfoyevqvVx2WT0xvgCbdDet8Hr69UQ9crPIT
6hISAC9v5l9wgWKT+QELlm6AQpmB74imKIblnt6CFd4G88zk66HelZM+Et21p1nK
3RJEutnErzbLTYI31IsQIeAfAo4G6JTqf3tpyxrXW1JL1zanxrSdwDd/oO0pkZDk
ml/a7IGR2XnR48kUbiSGIPIdp5dLuk2w0erWr+uZRK/904QvzLWiygzb1sdoZqXp
owTWOauBmI824L3nkDonWoZro+2ReNsp0VEF9l1fmCEJCtfyQFc=
=oTlK
-----END PGP SIGNATURE-----