Security update for python-pdfminer.six (important)

openSUSE Security Update: Security update for python-pdfminer.six Announcement ID: openSUSE-SU-2025:0428-1 Rating: important References: 1253228 Cross-References: CVE-2025-64512 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description:...

OPENSUSE-SU-2025:15727-1 python311-pdfminer.six-20251107-1.1 on GA media

These are all security issues fixed in the python311-pdfminer.six-20251107-1.1 package on the GA media of openSUSE Tumbleweed...

UBUNTU-CVE-2025-64512

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB.loaddata function in...

CVE-2025-64512 pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB.loaddata function in...

CVE-2025-64512

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB.loaddata function in...

CVE-2025-64512

pdfminer.six contains an insecure deserialization vulnerability in the CMap loading path. The library uses pickle.loads() to deserialize CMap cache files; a malicious PDF can cause execution of code by pointing to a crafted .pickle.gz in the cmap directory. Affected releases are before the upstre...

GHSA-F83H-GHPP-7WCC Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...

EUVD-2025-38331

Insecure Deserialization pickle in pdfminer.six CMap Loader — Local Privesc...

edspdf (>=0.5.0b0, <=0.5.3), ocrmypdf (>=13.4.2, <=13.4.3) +3 more potentially affected by CVE-2025-64512 via pdfminer-six (20220319.0.0)

pdfminer-six PYPI version 20220319.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - edspdf =0.5.0b0, =13.4.2, =0.6.1, =1.4.0, =2.4.24, =3.2.9 Source cves: CVE-2025-64512 Source advisory: OSV:GHSA-WF5F-4JWR-PPCP...

ocrmypdf (>=9.6.0, <=9.7.1), screenplay-pdf-to-json (>=0.1.0, <=0.3.4) +2 more potentially affected by CVE-2025-64512 via pdfminer-six (20200124.0.0)

pdfminer-six PYPI version 20200124.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - ocrmypdf =9.6.0, =0.1.0, =1.34.27, =1.36.9 Source cves: CVE-2025-64512 Source advisory: OSV:GHSA-WF5F-4JWR-PPCP...

deckz (2.6.0), ocrmypdf (>=9.7.2, <=9.8.0) +4 more potentially affected by CVE-2025-64512 via pdfminer-six (20200402.0.0)

pdfminer-six PYPI version 20200402.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - deckz 2.6.0 - ocrmypdf =9.7.2, =0.1.0, =1.0.0, =1.36.10, =1.38.1 Source cves: CVE-2025-64512 Source advisory:...

EUVD-2025-38315

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input...

ocrmypdf (>=9.4.0, <=9.5.0), seleniumbase (>=1.34.12, <=1.34.25) potentially affected by CVE-2025-64512 via pdfminer-six (20200104.0.0)

pdfminer-six PYPI version 20200104.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - ocrmypdf =9.4.0, =1.34.12, =1.34.25 Source cves: CVE-2025-64512 Source advisory: OSV:GHSA-WF5F-4JWR-PPCP...

bankruptcy (>=0.0.2, <=0.0.5), copy-spotter (>=0.1.12, <=0.1.16) +7 more potentially affected by CVE-2025-64512 via pdfminer-six (20200517.0.0)

pdfminer-six PYPI version 20200517.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - bankruptcy =0.0.2, =0.1.12, =1.1.1, =0.1.0a1, =9.8.1, =0.4.0, =1.38.2, =1.42.15 Source cves: CVE-2025-64512 Source advisory:...

aient (>=1.0.29, <=1.2.57), automateboringstuff3 (>=2024.8.8, <=2024.10.1) +17 more potentially affected by CVE-2025-64512 via pdfminer-six (20240706.0.0)

pdfminer-six PYPI version 20240706.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - aient =1.0.29, =2024.8.8, =0.1.17, =0.8.0, =1.5.3, =1.5.3, =1.5.3, =1.0.8, =1.0.0a2, =0.5.5, =1.2.0, =0.0.2, =0.1.0, =0.1.10 and...

aiecs (>=1.0.0, <=2.1.0), botrun-flow-lang (>=5.8.51, <=6.4.21) +20 more potentially affected by CVE-2025-64512 via pdfminer-six (20250506.0.0)

pdfminer-six PYPI version 20250506.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - aiecs =1.0.0, =5.8.51, =0.1.0, =1.4.3, =1.8.0, =1.8.0, =1.2.48, =3.2.0, =0.0.1b1, =0.3.0, =0.2.0, =0.1.0, =1.3.11, =2.0.0, =2.7.0...

agentix-agent-sdk (0.1.0), agixt (>=1.7.0, <=1.7.11) +60 more potentially affected by CVE-2025-64512 via pdfminer-six (20231228.0.0)

pdfminer-six PYPI version 20231228.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - agentix-agent-sdk 0.1.0 - agixt =1.7.0, =1.0.0, =0.1.1, =5.2.161, =1.0.0, =0.1.0, =2.2.5rc1, =1.1.6, =0.1.0, =0.1.0, =2024.5.10,...

seleniumbase (1.34.26) potentially affected by CVE-2025-64512 via pdfminer-six (20200121.0.0)

pdfminer-six PYPI version 20200121.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - seleniumbase 1.34.26 Source cves: CVE-2025-64512 Source advisory: OSV:GHSA-WF5F-4JWR-PPCP...

beancount-importer (>=0.2.0, <=0.3.0), bib-dedupe (>=0.1.0, <=0.3.0) +28 more potentially affected by CVE-2025-64512 via pdfminer-six (20220524.0.0)

pdfminer-six PYPI version 20220524.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - beancount-importer =0.2.0, =0.1.0, =0.5.5, =0.9.3, =0.0.5, =0.1.0, =0.0.1, =0.1.2, =3.5.0, =0.3.0, =0.4.8 and more Source cves:...