Vulnerability Lookup

🛡️ CVE-2022-38171

🟠 CVSS 7.8 — High ✅ No Known Exploit CWE-190 NVD

7.8

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

Details

Severity HIGH

CVSS Score 7.8

CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE CWE-190

Public Exploit ✅ No

Source NVD

Published 2022-08-22

Updated 2026-06-08

Modified 2024-11-21

Fix URL https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md

Affected Packages

Software	From version	Fixed in
poppler	—	22.09.0
xpdf	—	—

References

Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/09/02/11

Vendor Advisory http://www.xpdfreader.com/security-fixes.html

Vendor Advisory https://dl.xpdfreader.com/xpdf-4.04.tar.gz

Third Party Advisory https://github.com/jeffssh/CVE-2021-30860

Patch, Third Party Advisory https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md

Third Party Advisory https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

Third Party Advisory https://www.cve.org/CVERecord?id=CVE-2021-30860

Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/09/02/11

Vendor Advisory http://www.xpdfreader.com/security-fixes.html

Vendor Advisory https://dl.xpdfreader.com/xpdf-4.04.tar.gz

Third Party Advisory https://github.com/jeffssh/CVE-2021-30860

Patch, Third Party Advisory https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md

Third Party Advisory https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

Third Party Advisory https://www.cve.org/CVERecord?id=CVE-2021-30860

🔗 NVD 🔗 Mitre ✅ Fix / Advisory

Similar Threats

Site Security Check

Concerned your site may already be targeted?

BotEraser analyzes incoming traffic patterns and helps identify bot behavior consistent with known exploit attempts.

Check My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Concerned your site may already be targeted?

Company

Resources

Services

Trusted

Subscribe