CVE-2022-38784

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
References
Link Resource
https://poppler.freedesktop.org/releases.html Release Notes Vendor Advisory
https://github.com/jeffssh/CVE-2021-30860 Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1261/diffs?commit_id=27354e9d9696ee2bc063910a6c9a6b27c5184a52 Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/02/11 Mailing List Third Party Advisory
https://www.debian.org/security/2022/dsa-5224 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQAO6O2XHPQHNW2MWOCJJ4C3YWS2VV4K/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J546EJUKUOPWA3JSLP7DYNBAU3YGNCCW/ Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html Third Party Advisory
https://security.gentoo.org/glsa/202209-21 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BGY72LBJMFAKQWC2XH4MRPIGPQLXTFL6/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLKN3HJKZSGEEKOF57DM7Q3IB74HP5VW/ Mailing List Third Party Advisory
https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md Exploit Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-38171 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E5Z2677EQUWVHJLGSH5DQX53EK6MY2M2/ Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

History

28 Oct 2022, 20:08

Type Values Removed Values Added
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLKN3HJKZSGEEKOF57DM7Q3IB74HP5VW/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLKN3HJKZSGEEKOF57DM7Q3IB74HP5VW/ - Mailing List, Third Party Advisory
References (MISC) https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md - (MISC) https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md - Exploit, Third Party Advisory
References (MISC) https://www.cve.org/CVERecord?id=CVE-2022-38171 - (MISC) https://www.cve.org/CVERecord?id=CVE-2022-38171 - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E5Z2677EQUWVHJLGSH5DQX53EK6MY2M2/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E5Z2677EQUWVHJLGSH5DQX53EK6MY2M2/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BGY72LBJMFAKQWC2XH4MRPIGPQLXTFL6/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BGY72LBJMFAKQWC2XH4MRPIGPQLXTFL6/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

20 Oct 2022, 18:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E5Z2677EQUWVHJLGSH5DQX53EK6MY2M2/ -

18 Oct 2022, 19:15

Type Values Removed Values Added
References
  • {'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38171', 'name': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38171', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://gist.github.com/zmanion/b2ed0d1a0cec163ecd07d5e3d9740dc6', 'name': 'https://gist.github.com/zmanion/b2ed0d1a0cec163ecd07d5e3d9740dc6', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'MISC'}
  • (MISC) https://www.cve.org/CVERecord?id=CVE-2022-38171 -
  • (MISC) https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md -

10 Oct 2022, 02:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLKN3HJKZSGEEKOF57DM7Q3IB74HP5VW/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BGY72LBJMFAKQWC2XH4MRPIGPQLXTFL6/ -

30 Sep 2022, 19:51

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202209-21 - (GENTOO) https://security.gentoo.org/glsa/202209-21 - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQAO6O2XHPQHNW2MWOCJJ4C3YWS2VV4K/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQAO6O2XHPQHNW2MWOCJJ4C3YWS2VV4K/ - Mailing List, Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2022/dsa-5224 - (DEBIAN) https://www.debian.org/security/2022/dsa-5224 - Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J546EJUKUOPWA3JSLP7DYNBAU3YGNCCW/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J546EJUKUOPWA3JSLP7DYNBAU3YGNCCW/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
First Time Fedoraproject
Debian debian Linux
Debian
Fedoraproject fedora

29 Sep 2022, 17:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202209-21 -

26 Sep 2022, 02:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html -

22 Sep 2022, 03:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQAO6O2XHPQHNW2MWOCJJ4C3YWS2VV4K/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J546EJUKUOPWA3JSLP7DYNBAU3YGNCCW/ -

07 Sep 2022, 04:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5224 -

02 Sep 2022, 21:51

Type Values Removed Values Added
First Time Freedesktop
Freedesktop poppler
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.8
CWE CWE-190
References
  • (MLIST) http://www.openwall.com/lists/oss-security/2022/09/02/11 - Mailing List, Third Party Advisory
References (MISC) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38171 - (MISC) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38171 - Third Party Advisory
References (CONFIRM) https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1261/diffs?commit_id=27354e9d9696ee2bc063910a6c9a6b27c5184a52 - (CONFIRM) https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1261/diffs?commit_id=27354e9d9696ee2bc063910a6c9a6b27c5184a52 - Patch, Vendor Advisory
References (MISC) https://gist.github.com/zmanion/b2ed0d1a0cec163ecd07d5e3d9740dc6 - (MISC) https://gist.github.com/zmanion/b2ed0d1a0cec163ecd07d5e3d9740dc6 - Patch, Third Party Advisory
References (CONFIRM) https://poppler.freedesktop.org/releases.html - (CONFIRM) https://poppler.freedesktop.org/releases.html - Release Notes, Vendor Advisory
References (MISC) https://github.com/jeffssh/CVE-2021-30860 - (MISC) https://github.com/jeffssh/CVE-2021-30860 - Third Party Advisory
CPE cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*

30 Aug 2022, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-08-30 03:15

Updated : 2022-10-28 20:08


NVD link : CVE-2022-38784

Mitre link : CVE-2022-38784


JSON object : View

Products Affected

freedesktop

  • poppler

fedoraproject

  • fedora

debian

  • debian_linux
CWE
CWE-190

Integer Overflow or Wraparound