Vulnerability · Published Aug 30, 2022 · Assigned by mitre
CVE-2022-38784
High 7.8
In plain English
A high-severity security flaw in the poppler package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.6%top 49.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | poppler | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-cpp | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-cpp | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-cpp-devel | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-cpp-devel | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-devel | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-devel | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-glib | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-glib | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-glib-devel | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-glib-devel | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-qt5 | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-qt5 | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-qt5-devel | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-qt5-devel | 21.01.0-14.el9 | ALSA-2023:2259 |
| AlmaLinux:8 | poppler-utils | 20.11.0-6.el8 | ALSA-2023:2810 |
| AlmaLinux:9 | poppler-utils | 21.01.0-14.el9 | ALSA-2023:2259 |
| Debian:12 | poppler | 22.08.0-2.1 | DEBIAN-CVE-2022-38784 |
| Debian:13 | poppler | 22.08.0-2.1 | DEBIAN-CVE-2022-38784 |
| Debian:14 | poppler | 22.08.0-2.1 | DEBIAN-CVE-2022-38784 |
| Rocky Linux:8 | poppler | 0:20.11.0-6.el8 | RLSA-2023:2810 |
| Ubuntu:22.04:LTS | emscripten | no fix listed | UBUNTU-CVE-2022-38784 |
| Ubuntu:24.04:LTS | emscripten | no fix listed | UBUNTU-CVE-2022-38784 |
| Ubuntu:25.10 | emscripten | no fix listed | UBUNTU-CVE-2022-38784 |
| Ubuntu:26.04:LTS | emscripten | no fix listed | UBUNTU-CVE-2022-38784 |
| Ubuntu:26.10 | emscripten | no fix listed | UBUNTU-CVE-2022-38784 |
| Ubuntu:22.04:LTS | poppler | 22.02.0-2ubuntu0.1 | UBUNTU-CVE-2022-38784 |
| Ubuntu:22.04:LTS | poppler | 22.02.0-2ubuntu0.1 | USN-5606-1 |
Affected products (as reported)
References
- https://github.com/jeffssh/CVE-2021-30860
- https://poppler.freedesktop.org/releases.html
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1261/diffs?commit_id=27354e9d9696ee2bc063910a6c9a6b27c5184a52
- [oss-security] 20220902 JBIG2 integer overflow fixed in Xpdf 4.04, Poppler 22.09.0 mailing-list
- DSA-5224 vendor-advisory
- FEDORA-2022-f7b375eae8 vendor-advisory
- FEDORA-2022-51b27699ce vendor-advisory
- [debian-lts-announce] 20220925 [SECURITY] [DLA 3120-1] poppler security update mailing-list
- GLSA-202209-21 vendor-advisory
- FEDORA-2022-f79aa2bae9 vendor-advisory
- FEDORA-2022-fcb3b063a6 vendor-advisory
- https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md
- https://www.cve.org/CVERecord?id=CVE-2022-38171
- FEDORA-2022-f8ec1c06a3 vendor-advisory