Lucene search

K
cve[email protected]CVE-2022-38171
HistoryAug 22, 2022 - 7:15 p.m.

CVE-2022-38171

2022-08-2219:15:11
CWE-190
web.nvd.nist.gov
229
In Wild
8
xpdf
version 4.04
integer overflow
jbig2 decoder
crash
arbitrary code execution
cve-2022-38171
nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.5%

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

Affected configurations

NVD
Node
xpdfreaderxpdfMatch4.04
Node
freedesktoppopplerRange<22.09.0
CPENameOperatorVersion
xpdfreader:xpdfxpdfreader xpdfeq4.04

Social References

More

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.5%