Ubuntu USN-8837-1 Fixes pdfminer Vulnerabilities
Tech GuruQuick Answer
USN-8837-1 fixes two crafted-PDF parsing flaws that could execute code in the context of the process using pdfminer. Check document-ingestion services as well as desktop tools: the relevant exposure is an affected parser accepting attacker-controlled PDFs.
Confirm Scope And Apply The Supported Fix
What to do now: match the parser actually loaded by each PDF workflow to its package source. Ubuntu lists python3-pdfminer for noble, jammy and focal, and python-pdfminer for bionic and xenial. Update the installed package through its supported channel and restart long-lived consumers before testing a benign PDF.
Last verified: October 2, 2026 UTC against Ubuntu's binary-package table. No PDF parsing or exploit test was performed.
Scope And Authority
| Product scope | pdfminer vulnerabilities on Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial) |
|---|---|
| Advisory | USN-8837-1 |
| CVEs | CVE-2025-64512, CVE-2025-70559 |
| Authoritative release date | 2026-09-28 14:43:34.219690 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8837-1: Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial). |
| Fixed version | bionic: python-pdfminer 20140328+dfsg-1ubuntu0.18.04.1~esm1 / focal: python3-pdfminer 20191020+dfsg-2ubuntu0.1~esm1 / jammy: python3-pdfminer 20220319+dfsg-1ubuntu0.1~esm1 / noble: python3-pdfminer 20221105+dfsg-1ubuntu0.1~esm1 / xenial: python-pdfminer 20140328+dfsg-1ubuntu0.16.04.1~esm1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
pdfminer could be made to run programs as your login if it opened a specially crafted file. In general, a standard system update will make all the necessary changes.
What To Validate Now
- Trace the consumer. Identify the PDF worker, interpreter/environment and installed parser package. Check container images and virtual environments separately from the host.
- Update the correct artifact. Use the binary name and fixed build listed for that Ubuntu release, or a supported superseding update. A pip copy is not repaired by changing an unrelated system package.
- Verify processing. Restart persistent workers as appropriate, process a known benign PDF through the real ingestion route, and compare extracted text, errors and queue behavior.
- Preserve evidence. Keep parser provenance, image/package versions and the test result. Until remediation is confirmed, constrain untrusted PDF ingestion rather than interpreting successful extraction as proof against exploitation.
Operational Cautions
Some listed fixes are delivered through Ubuntu Pro or ESM. Confirm entitlement and repository state before the change, use the exact supported release stream, and test dependent services, clusters, and rollback. Severity alone is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
