PT-2022-5566 · Poppler+10 · Poppler+10

Jieyong Ma · Published 2022-03-15 · Updated 2025-09-10 · CVE-2022-27337

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Poppler version 22.03.0

Description A logic error in the Hints::Hints function allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. The issue is related to errors in resource release. Exploitation of the issue enables a remote attacker to cause a denial of service using a specially crafted PDF file.

Recommendations For Poppler version 22.03.0, consider disabling the Hints::Hints function as a temporary workaround until a patch is available. Restrict access to crafted PDF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALSA-2022:7594

ALSA-2022:8151

ALT-PU-2022-3233

ALT-PU-2023-1100

ALT-PU-2025-9424

BDU:2022-06926

CESA-2022_7594

CVE-2022-27337

DLA-3120-1

DSA-5224-1

MGASA-2022-0282

OESA-2023-1183

OPENSUSE-SU-2023_2941-1

OPENSUSE-SU-2023_3168-1

RHSA-2022:7594

RHSA-2022:8151

RHSA-2022_7594

RHSA-2022_8151

RLSA-2022:7594

RLSA-2022:8151

SUSE-SU-2023:2838-1

SUSE-SU-2023:2906-1

SUSE-SU-2023:2907-1

SUSE-SU-2023:2941-1

SUSE-SU-2023:3168-1

SUSE-SU-2023_2941-1

SUSE-SU-2023_3168-1

USN-6273-1

USN-7687-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Poppler

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 93

• 🔥 https://github.com/jeffssh/CVE-2021-30860 · Exploit
• 🔥 https://github.com/Levilutz/CVE-2021-30860 · Exploit
• 🔥 https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md · Exploit
• 🔥 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1230 · Exploit
• 🔥 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1230#note_1372177 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KOTDUXJOKDYO4I7MKHLT5NBGTN5E7FHQ · Vendor Advisory
• https://osv.dev/vulnerability/USN-7687-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6273-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27337 · Security Note
• https://ubuntu.com/security/notices/USN-6273-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0282.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-27337 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-7594.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-27337 · Security Note