Advisories » MGASA-2024-0035

Updated xpdf packages fix security vulnerabilities

Publication date: 10 Feb 2024
Modification date: 10 Feb 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2022-30524 , CVE-2022-30775 , CVE-2022-33108 , CVE-2022-36561 , CVE-2022-38222 , CVE-2022-38334 , CVE-2022-38928 , CVE-2022-41842 , CVE-2022-41843 , CVE-2022-41844 , CVE-2022-43071 , CVE-2022-43295 , CVE-2022-45586 , CVE-2022-45587 , CVE-2023-2662 , CVE-2023-2663 , CVE-2023-2664 , CVE-2023-3044 , CVE-2023-3436

Description

The updated packages fix security vulnerabilities:
Logic bug in text extractor led to invalid memory access.
(CVE-2022-30524)
Integer overflow in rasterizer. (CVE-2022-30775)
PDF object loop in Catalog::countPageTree. (CVE-2022-33108)
PDF object loop in AcroForm::scanField. (CVE-2022-36561)
Logic bug in JBIG2 decoder. (CVE-2022-38222)
PDF object loop in Catalog::countPageTree. (CVE-2022-38334)
Missing bounds check in CFF font converter caused null pointer
dereference. (CVE-2022-38928)
PDF object loop in Catalog::countPageTree. (CVE-2022-41842)
Missing bounds check in CFF font parser caused invalid memory access.
(CVE-2022-41843)
PDF object loop in AcroForm::scanField. (CVE-2022-41844)
PDF object loop in Catalog::readPageLabelTree2. (CVE-2022-43071)
PDF object loop in Catalog::countPageTree. (CVE-2022-43295)
PDF object loop in Catalog::countPageTree. (CVE-2022-45586)
PDF object loop in Catalog::countPageTree. (CVE-2022-45587)
Divide-by-zero in Xpdf 4.04 due to bad color space object.
(CVE-2023-2662)
PDF object loop in Catalog::readPageLabelTree2. (CVE-2023-2663)
PDF object loop in Catalog::readEmbeddedFileTree. (CVE-2023-2664)
Divide-by-zero in Xpdf 4.04 due to very large page size. (CVE-2023-3044)
Deadlock in Xpdf 4.04 due to PDF object stream references.
(CVE-203-3436)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=30812
• http://www.xpdfreader.com/security-fixes.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30524
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30775
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33108
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36561
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38222
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38334
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38928
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41842
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41843
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41844
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43071
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43295
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45586
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45587
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2662
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2663
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2664
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3436

SRPMS

9/core

• xpdf-4.05-1.mga9