CVE-2022-37050

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37050.json"
}

References

Affected packages

Git / gitlab.freedesktop.org/poppler/poppler

Affected ranges

Type

GIT

Repo

https://gitlab.freedesktop.org/poppler/poppler

Events

Introduced

bb1651334abc11495fa0326c8d562243d2a4b055

Fixed

dcd5bd8238ea448addd102ff045badd0aca1b990

Database specific

{
    "cpe": "cpe:2.3:a:freedesktop:poppler:22.07.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "22.07.0"
        },
        {
            "last_affected": "22.07.0"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

22.*

22.07.0

poppler-22.*

poppler-22.07.0

Database specific

vanir_signatures_modified

"2026-07-22T02:07:58Z"

vanir_signatures

[
    {
        "target": {
            "file": "poppler/PDFDoc.cc"
        },
        "id": "CVE-2022-37050-2688e38d",
        "digest": {
            "line_hashes": [
                "114842602092432893778271834459282916621",
                "106906025405781008382997333553472705956",
                "297354338754434299385182409393809636327",
                "326917231957895818469694738405259608057"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://gitlab.freedesktop.org/poppler/poppler@dcd5bd8238ea448addd102ff045badd0aca1b990"
    },
    {
        "target": {
            "function": "PDFDoc::savePageAs",
            "file": "poppler/PDFDoc.cc"
        },
        "id": "CVE-2022-37050-b72075c3",
        "digest": {
            "function_hash": "233931809287936889414848428528741274552",
            "length": 5212.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://gitlab.freedesktop.org/poppler/poppler@dcd5bd8238ea448addd102ff045badd0aca1b990"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37050.json"