diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000000000000000000000000000000000..d87f5613ec4234f82f8eaeebc563711f587fdf88
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.xz filter=lfs diff=lfs merge=lfs -text
diff --git a/.lfsconfig b/.lfsconfig
new file mode 100644
index 0000000000000000000000000000000000000000..eca57599babeb514a4361f23518458c6ad868a37
--- /dev/null
+++ b/.lfsconfig
@@ -0,0 +1,2 @@
+[lfs]
+	url = https://artlfs.openeuler.openatom.cn/src-openEuler/poppler
diff --git a/backport-CVE-2025-32364.patch b/backport-CVE-2025-32364.patch
new file mode 100644
index 0000000000000000000000000000000000000000..2d4f2c6dbd8a2d081e1e6fc342118a7c80bc8f7d
--- /dev/null
+++ b/backport-CVE-2025-32364.patch
@@ -0,0 +1,25 @@
+From d87bc726c7cc98f8c26b60ece5f20236e9de1bc3 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Mon, 24 Mar 2025 00:44:54 +0100
+Subject: [PATCH] PSStack::roll: Protect against doing int = -INT_MIN
+
+---
+ poppler/Function.cc | 2 +-
+ 1 file changed, 1 insertion(+),  deletion(-)
+
+diff --git a/poppler/Function.cc b/poppler/Function.cc
+index d84c4e350..f3168f191 100644
+--- a/poppler/Function.cc
++++ b/poppler/Function.cc
+@@ -1099,7 +1099,7 @@
+   PSObject obj;
+   int i, k;
+ 
+-  if (unlikely(n == 0)) {
++  if (unlikely(n == 0 || j == INT_MIN)) {
+     return;
+   }
+   if (j >= 0) {
+-- 
+GitLab
+
diff --git a/backport-CVE-2025-32365.patch b/backport-CVE-2025-32365.patch
new file mode 100644
index 0000000000000000000000000000000000000000..3ad35ac6909b04203acf12f601fd3d8bce364fdd
--- /dev/null
+++ b/backport-CVE-2025-32365.patch
@@ -0,0 +1,27 @@
+From 1f151565bbca5be7449ba8eea6833051cc1baa41 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Mon, 31 Mar 2025 14:35:49 +0200
+Subject: [PATCH] Move isOk check to inside JBIG2Bitmap::combine
+
+---
+ poppler/JBIG2Stream.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
+index cf9e0c984..4e81d4a8c 100644
+--- a/poppler/JBIG2Stream.cc
++++ b/poppler/JBIG2Stream.cc
+@@ -862,6 +862,10 @@
+   unsigned int src0, src1, src, dest, s1, s2, m1, m2, m3;
+   bool oneByte;
+ 
++  if (unlikely(!isOk())) {
++    return;
++  }
++
+   // check for the pathological case where y = -2^31
+   if (y < -0x7fffffff) {
+     return;
+-- 
+GitLab
+
diff --git a/poppler-0.90.0.tar.xz b/poppler-0.90.0.tar.xz
index 7abd8ff4242b70572f4ca82e14599d61bae4dd2b..fbdf1110d5fa70f3dbed86fc9ebaf88fe3ec1239 100644
Binary files a/poppler-0.90.0.tar.xz and b/poppler-0.90.0.tar.xz differ
diff --git a/poppler-test-2018-12-18-45f55f1e03b9bf3fbd334c31776b6f5e472889ec.tar.xz b/poppler-test-2018-12-18-45f55f1e03b9bf3fbd334c31776b6f5e472889ec.tar.xz
index c168d867a6f4ed87357a869a589055cbc64a5926..412692ca021009bdc330dd809531169c9150a641 100644
Binary files a/poppler-test-2018-12-18-45f55f1e03b9bf3fbd334c31776b6f5e472889ec.tar.xz and b/poppler-test-2018-12-18-45f55f1e03b9bf3fbd334c31776b6f5e472889ec.tar.xz differ
diff --git a/poppler.spec b/poppler.spec
index d5ff981be4ce48f8d65d3081dcbe8f0487eed031..01ae74ac4ae3745d409af50e311a8fb8fb18275b 100644
--- a/poppler.spec
+++ b/poppler.spec
@@ -4,7 +4,7 @@
 Summary:        PDF rendering library
 Name:           poppler
 Version:        0.90.0
-Release:        10
+Release:        11
 License:        (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
 URL:            http://poppler.freedesktop.org/
 Source0:        http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@@ -26,6 +26,8 @@ Patch6008:	backport-CVE-2020-36023.patch
 Patch6009:	backport-CVE-2024-6239.patch
 Patch6010:	backport-CVE-2024-4141.patch
 Patch6011:	backport-CVE-2024-56378.patch
+Patch6012:      backport-CVE-2025-32364.patch
+Patch6013:      backport-CVE-2025-32365.patch
 
 BuildRequires:  cmake
 BuildRequires:  gcc-c++
@@ -225,6 +227,9 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
 %{_mandir}/man1/*
 
 %changelog
+* Sun Apr 06 2025 Funda Wang <fundawang@yeah.net> - 0.90.0-11
+- fix CVE-2025-32364, CVE-2025-32365
+
 * Mon Dec 23 2024 Funda Wang <fundawang@yeah.net> - 0.90.0-10
 - fix CVE-2024-56378