🛡️ openSUSE-SU-2026:20923-1 — apache-pdfbox (CVE-2026-33929 +1 more)

Security update for apache-pdfbox

This update for apache-pdfbox fixes the following issues:

Update to version 2.0.36.

Security issues fixed:

• CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes

(bsc#1262046).

Other updates and bugfixes:

• Version 2.0.36:
• XMPBox removes namespaces on serialization
• False negative on PDFA-1b validation : missing field type
• PlainText.Paragraph.getLines extremely slow on long lines
• Valid PDF/A 1B is rejected
• Potential StackOverflows in BaseParser
• Unknown code in Huffman RLE stream
• IllegalArgumentException: Can't add attribute to 0-length text
• TTFSubsetter.buildGlyfTable() modifies glyphIds while iterating over its entries possibly causing

ConcurrentModificationException to be thrown

• IndexOutOfBoundsException in Type1CharStringParser.processCallSubr()
• Exception "No type defined for {http://www.aiim.org/pdfa/ns/id/}rev" when trying to determine version of PDF/A-4

document

• allow new PDF/A-4 conformance levels
• pdfbox-app-X.X.X-sources.jar on maven central are empty (and javadoc jar is missing)
• Cmd line docs
• IllegalArgumentException: Multiplying two matrices produces illegal values in PDFStreamEngine.processAnnotation()
• XmpParsingException: Schema is not set in this document: http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
• NullPointerException in FontMapperImpl.getFontMatches()
• border style in FDFAnnotation is not initialized if width is 0
• German umlauts are not rendered
• Invalid type in Schema not detected when in XML attributes
• Serializing produces date "1-01-01T00:00:00+01:00"
• Seconds of date "D:2015-02-03T10:11:12" returned as 0
• Confusing naming of "DerivedFrom" property getter in XMPMediaManagementSchema
• ClassCastException in XMPMediaManagementSchema.getHistory()
• IllegalArgumentException: Input buffer too short in StandardSecurityHandler.computeRC4key()
• IllegalArgumentException: Width (0) and height (0) cannot be <= 0 when printing landscape rotated with

RASTERIZE_DPI_AUTO

• DateConverter fails on valid date
• ClassCastException: class org.apache.xmpbox.type.TextType cannot be cast to class

org.apache.xmpbox.type.ArrayProperty in DublinCoreSchema.getCreatorsProperty()

• tiff:YCbCrSubSampling and tiff:YCbCrPositioning have wrong cardinality
• ClassCastException: class org.apache.xmpbox.type.FlashType
• Cannot find a definition for the namespace http://www.w3.org/1999/02/22-rdf-syntax-ns#, property:

rdf:Description http://ns.adobe.com/xap/1.0/sType/ResourceEvent#, property:stEvt:action

• XmpParsingException: Missing pdfaSchema:property in type definition in lenient mode
• XmpParsingException: Unknown property value type : Open Choice of Integer
• XmpParsingException: Property 'CountryCode' not defined in http://www.epo.org/patent-bibliographic-data/1.0/
• date "0-00-00T00:00:00-04:00" read as "0002-11-30T00:00:00-40:00"
• XmpParsingException: Type 'stRef:documentName' not defined in http://ns.adobe.com/xap/1.0/sType/ResourceRef# in

lenient mode

• Invalid PDF/A namespace definition, prefix: xmlns, namespace: http://www.aiim.org/pdfa/ns/extension/

http://www.aiim.org/pdfa/ns/extension/, property: pdfaExtension:schemas

• NegativeArraySizeException in PredictorOutputStream()
• NullpointerException in PDAcroForm.getField(Line 485)
• OutOfMemoryError when trying to extract text from pdf
• Outlines circular reference vulnerability
• Rendered text missing
• Inverted images due to enlarged decode array
• PDF displays garbled characters in Adobe Reader but renders correctly in web browsers
• NullPointerException while merging PDFs with output intents
• Valid XMP Extension Schema rejected
• Remove dead code from PDFMarkedContentExtractor
• Include test file in test class
• Get and Add PageTextSchema
• Remove / deprecate TypeMapping.getAssociatedSchemaObject()
• Support Seq / Bag mixup in lenient mode
• Parse xmp files in lenient mode that have no processing instructions
• deprecate getPDFIdentificationSchema() in favor of getPDFAIdentificationSchema()
• Support TIFF-files with FillOrder=2 conversion to PDF
• Remove / deprecate unused parts of PDIndexed
• modernize rat exclusions
• Version 2.0.35:
• NegativeArraySizeException with PDF file with huge fonts
• Inline image bug with multi-byte newline tokens
• fix initial ByteArrayOutputStream size for deflate operation
• PDF takes an hour to render
• Splitter does not include structure tree in documents past the first split
• build fails on jdk11
• Load a TTF font which is from Mac OS throw an exception
• Wrong glyphs since PDFBOX-5790
• ClassCastException on broken file in PDEmbeddedFilesNameTreeNode.convertCOSToPD()
• invalid XMP generated when Apache Xalan in the classpath
• XMP JobType constructor ignores fieldPrefix
• NullPointerException in xmpbox serializer if a date