p PatchFirst

CVE-2025-70559

CVE-2025-70559

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • pdfminer Debian:12

    Versions
    • 20221105+dfsg-1
    • 20221105+dfsg-1.1
    • 20221105+dfsg-1.1~deb12u1
    • 20221105+dfsg-1.1~deb13u1
    • 20260107+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdfminer Debian:13

    Versions
    • 20221105+dfsg-1
    • 20221105+dfsg-1.1
    • 20221105+dfsg-1.1~deb12u1
    • 20221105+dfsg-1.1~deb13u1
    • 20260107+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdfminer Debian:14

    Versions
    • 20221105+dfsg-1
    • 20221105+dfsg-1.1
    • 20221105+dfsg-1.1~deb12u1
    • 20221105+dfsg-1.1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 20260107+dfsg-1

    Update to 20260107+dfsg-1

  • pdfminer-six PyPI

    Versions
    • 20140915
    • 20151013
    • 20160202
    • 20160614
    • 20170418
    • 20170419
    • 20170720
    • 20181108
    • 20191020
    • 20191107
    • 20191110
    • 20200104
    • 20200121
    • 20200124
    • 20200401
    • 20200402
    • 20200517
    • 20200720
    • 20200726
    • 20201018
    • 20211012
    • 20220319
    • 20220506
    • 20220524
    • 20221105
    • 20231228
    • 20240706
    • 20250324
    • 20250327
    • 20250416
    • 20250506
    • 20251107
    • 20251227
    • 20251228
    • 20251229
    Affected ranges
    • ECOSYSTEM: < 20251230

    Update to 20251230

  • pdfminer Ubuntu:Pro:16.04:LTS

    Versions
    • 20110515+dfsg-1
    • 20140328+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20140328+dfsg-1ubuntu0.16.04.1~esm1

    Update to 20140328+dfsg-1ubuntu0.16.04.1~esm1

  • pdfminer Ubuntu:Pro:18.04:LTS

    Versions
    • 20140328+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20140328+dfsg-1ubuntu0.18.04.1~esm1

    Update to 20140328+dfsg-1ubuntu0.18.04.1~esm1

  • pdfminer Ubuntu:Pro:20.04:LTS

    Versions
    • 20181108+dfsg-3
    • 20191020+dfsg-1
    • 20191020+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 20191020+dfsg-2ubuntu0.1~esm1

    Update to 20191020+dfsg-2ubuntu0.1~esm1

  • pdfminer Ubuntu:Pro:22.04:LTS

    Versions
    • 20200726-1
    • 20201018+dfsg-1
    • 20220319+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20220319+dfsg-1ubuntu0.1~esm1

    Update to 20220319+dfsg-1ubuntu0.1~esm1

  • pdfminer Ubuntu:Pro:24.04:LTS

    Versions
    • 20221105+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20221105+dfsg-1ubuntu0.1~esm1

    Update to 20221105+dfsg-1ubuntu0.1~esm1

  • pdfminer Ubuntu:25.10

    Versions
    • 20221105+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →