PT-2022-20309 · Xpdf+1 · Xpdf+1

Elvadisas · Published 2022-05-16 · Updated 2024-08-08 · CVE-2022-30775

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions xpdf version 4.04

Description The issue arises when xpdf allocates excessive memory in response to crafted input. This can be triggered by sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE CXX COMPILER=afl-clang-fast++ option.

Recommendations For xpdf version 4.04, as a temporary workaround, consider restricting the use of the pdftoppm binary until a patch is available. Additionally, avoid using the DCMAKE CXX COMPILER=afl-clang-fast++ option to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2024-10474

ALT-PU-2024-10804

ALT-PU-2024-7465

CVE-2022-30775

MGASA-2024-0035

Affected Products

Alt Linux

Xpdf

References · 13

• 🔥 https://forum.xpdfreader.com/viewtopic.php?f=3&t=42264 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30775 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30775 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0035.html · Security Note
• https://ubuntu.com/security/CVE-2022-30775 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-30775 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0035 · Vendor Advisory
• https://t.me/cvenotify/30251 · Telegram Post
• https://bugs.mageia.org/show_bug.cgi?id=30812 · Note
• http://xpdfreader.com/security-fixes.html · Note
• https://t.me/cvenotify/30645 · Telegram Post
• https://t.me/cibsecurity/42714 · Telegram Post