Logo
›
›vulnerability›CVE-2022-38171
Name
CVE-2022-38171
Source
NVD ( link)Debian ( link)
Description
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
CWEs
CWE-190
Published Date
Updated Date
Workaround
-
Advisories
http://www.openwall.com/lists/oss-security/2022/09/02/11Mailing List
http://www.xpdfreader.com/security-fixes.htmlVendor Advisory
https://dl.xpdfreader.com/xpdf-4.04.tar.gzVendor Advisory
https://github.com/jeffssh/CVE-2021-30860Third Party Advisory
https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.mdPatch
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.htmlThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-30860Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/02/11Mailing List
http://www.xpdfreader.com/security-fixes.htmlVendor Advisory
https://dl.xpdfreader.com/xpdf-4.04.tar.gzVendor Advisory
https://github.com/jeffssh/CVE-2021-30860Third Party Advisory
https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.mdPatch
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.htmlThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-30860Third Party Advisory

Analysis#

Affected Component
Analysis
poppler
Patched

Vulnerability Rating#

7.8
CVSSv31

Others affected components#

Name
Project
Project Version
Version
Status
poppler
buildroot
2025.02.x
25.10.0
Not Affected
poppler
buildroot
master
25.10.0
Not Affected
poppler
yocto
master
25.12.0
Not Affected
poppler
yocto
scarthgap
23.04.0
Not Affected

Resolved with patches#

poppler (yocto:kirkstone)

#
Title
Author
Resolve
1
JBIG2Stream: Fix crash on broken file
Albert Astals Cid <aacid@kde.org>
CVE-2021-30860
CVE-2022-38171