845027 – (CVE-2022-30524, CVE-2022-30775, CVE-2022-38222, CVE-2022-38928, CVE-2022-41843) app-text/xpdf: multiple vulnerabilities ("fixed in next release")

Bug 845027 (CVE-2022-30524, CVE-2022-30775, CVE-2022-38222, CVE-2022-38928, CVE-2022-41843) - app-text/xpdf: multiple vulnerabilities ("fixed in next release")

Summary: app-text/xpdf: multiple vulnerabilities ("fixed in next release")

Status:	CONFIRMED

Alias:	CVE-2022-30524, CVE-2022-30775, CVE-2022-38222, CVE-2022-38928, CVE-2022-41843

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://forum.xpdfreader.com/viewtopi...
Whiteboard:	B3 [upstream]
Keywords:

Depends on:
Blocks:

Reported:	2022-05-16 16:39 UTC by John Helmert III
Modified:	2024-04-03 10:03 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-05-16 16:39:56 UTC

CVE-2022-30524:

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Comment 1 John Helmert III archtester

2022-05-16 17:00:32 UTC

CVE-2022-30775 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42264):

xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.

Comment 2 John Helmert III archtester

2022-08-23 01:40:57 UTC

Both "fixed in the next release" as of May, so not in 4.04.

Comment 3 John Helmert III archtester

2022-09-21 20:24:31 UTC

CVE-2022-38928 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42325&sid=7b08ba9a518a99ce3c5ff40e53fc6421):

XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.

Comment 4 John Helmert III archtester

2022-09-30 15:13:13 UTC

CVE-2022-38222 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42320):

There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.

CVE-2022-41843 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42325&sid=7b08ba9a518a99ce3c5ff40e53fc6421):
https://forum.xpdfreader.com/viewtopic.php?f=1&t=42344

An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.

These too "fixed in next release".