Advisories » MGASA-2022-0386

Updated poppler packages fix security vulnerability

Publication date: 23 Oct 2022
Modification date: 23 Oct 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-38784

Description

Poppler prior to and including 22.08.0 contains an integer overflow in the
JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc).
Processing a specially crafted PDF file or JBIG2 image could lead to a
crash or the execution of arbitrary code. This is similar to the
vulnerability described by CVE-2022-38171 in Xpdf. (CVE-2022-38784)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=30805
• https://www.openwall.com/lists/oss-security/2022/09/02/11
• https://www.debian.org/security/2022/dsa-5224
• https://ubuntu.com/security/notices/USN-5606-1
• https://ubuntu.com/security/notices/USN-5606-2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TQAO6O2XHPQHNW2MWOCJJ4C3YWS2VV4K/
• https://www.debian.org/lts/security/2022/dla-3120
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38784

SRPMS

8/core

• poppler-20.12.1-1.2.mga8